The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses ssh -G to validate configuration parsing. This is a safe, local-only command that does not establish network connections or execute remote code.
[CREDENTIALS_UNSAFE]: The instructions explicitly prohibit storing or submitting sensitive data. It contains a mandatory rule: 'Any stage must not output or submit private keys, passwords, tokens, agent sockets, .env, temporary command output, or unfiltered key material.'
[DATA_EXFILTRATION]: The skill operates on a local 'private Git repository' and emphasizes that it 'does not connect to remote ends by default.' Connectivity is only permitted with explicit user authorization per device.
[INDIRECT_PROMPT_INJECTION]: While the skill processes external TOML data, it implements strict boundary markers and schema validation. It includes an 'Inspect before change' phase and uses a 'strict versioned document' schema defined in references/device-schema.md to prevent confusion or injection from untrusted data fields.
[PRIVILEGE_ESCALATION]: The skill enforces domain boundaries that override generic tool defaults. It explicitly states that permissions granted to other tools (like Git/PR skills) do not automatically apply here, preventing accidental elevation of access during inventory management.
[REMOTE_CODE_EXECUTION]: Remote connection is strictly gated. The skill forbids using StrictHostKeyChecking=no to bypass security checks and requires independent fingerprint verification before updating known_hosts, effectively mitigating man-in-the-middle risks during remote operations.

ssh-fleet