The Agent Skills Directory

Indirect Prompt Injection (HIGH): The skill creates a high-risk attack surface by processing untrusted data (Supportbee tickets/customer messages) while maintaining write/execute capabilities.
Ingestion points: External content enters the agent context through RUBE_SEARCH_TOOLS and tool output results from Supportbee.
Boundary markers: No delimiters or instructions to ignore embedded commands are present in the skill.
Capability inventory: The skill utilizes RUBE_MULTI_EXECUTE_TOOL for writing/modifying data and RUBE_REMOTE_WORKBENCH for potentially arbitrary remote execution.
Sanitization: No evidence of input validation or output escaping for external content.
Unverifiable Dependencies & Remote Code Execution (HIGH): The skill relies on an external, untrusted endpoint https://rube.app/mcp as its primary infrastructure.
Remote execution: Uses RUBE_REMOTE_WORKBENCH which facilitates execution in a remote environment managed by an untrusted third party.
Dynamic execution: The agent is explicitly instructed to 'Always search first' and use discovered tool schemas, meaning the remote server can inject new tools or modify execution logic at runtime without local verification.
Privilege Escalation (MEDIUM): The RUBE_REMOTE_WORKBENCH capability provides an execution context that may have broader permissions than the agent's local environment, potentially allowing for sandbox escapes or broader network access.

supportbee-automation