The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/connect.sh allows for the execution of arbitrary bash commands on a remote server, which is the primary function of the skill.
[REMOTE_CODE_EXECUTION]: The skill facilitates the execution of code on remote infrastructure. The safety of this operation depends entirely on the integrity of the remote environment and the user's configuration.
[CREDENTIALS_UNSAFE]: The skill handles sensitive SSH credentials through environment variables and .env files.
Evidence: The script scripts/connect.sh uses the -A flag with the ssh command, enabling SSH Agent Forwarding. This allows the remote host to access the local SSH agent. If the remote server is compromised, an attacker could use this access to authenticate to other servers as the user.
Evidence: The script uses expect to automate ssh-add, passing the SSH_KEY_PASSWORD variable into a spawned process. Depending on the environment's process logging, this could expose the passphrase to other users on the system.
[PROMPT_INJECTION]: The skill is vulnerable to Indirect Prompt Injection because it ingests and processes untrusted data from remote servers.
Ingestion points: scripts/connect.sh captures and returns the standard output and error from remote SSH commands to the agent (e.g., reading server logs via docker compose logs).
Boundary markers: No boundary markers or delimiters are used to wrap the remote content or warn the agent to ignore instructions embedded in the output.
Capability inventory: The skill includes the capability to execute shell commands and manage Docker containers via ssh in scripts/connect.sh.
Sanitization: No sanitization or filtering of the remote command output is performed before it is provided to the agent.

ssh-remote-connection