The Agent Skills Directory

[Unverifiable Dependencies] (MEDIUM): The skill recommends installing podman-compose using pip install without version pinning. This poses a supply chain risk as it downloads the latest version of an external package from a public registry at runtime.
[Persistence Mechanisms] (MEDIUM): The skill contains instructions for creating systemd user services (using Quadlet/.container files) and enabling them with systemctl --user enable. While this is a primary use case for Podman (running services), it enables the creation of processes that persist across user sessions. Severity is downgraded from HIGH because this is a core intended functionality of the tool.
[Indirect Prompt Injection] (LOW): The skill implements commands that ingest untrusted data from external sources into the agent's context.
Ingestion points: podman logs and podman inspect (SKILL.md).
Boundary markers: Absent; there are no instructions to the agent to ignore instructions embedded in logs or metadata.
Capability inventory: The skill allows for command execution via podman exec, container creation via podman run, and host-level package installation via pip.
Sanitization: Absent; the output of logs and inspections is processed directly.
[Dynamic Execution] (LOW): The skill uses podman exec and podman run to launch processes inside containers. While isolated, this allows the execution of arbitrary commands, which is the primary purpose of the skill.

podman