The Agent Skills Directory

External Downloads / Remote Code Execution (HIGH): The file references/local-dev.md provides shell commands to download Restate Server and CLI binaries from restate.gateway.scarf.sh and GitHub releases under the restatedev organization. As neither the domain nor the organization are in the pre-approved trusted list, these instructions direct the agent to execute untrusted code. \n
Evidence: curl -L --remote-name-all https://restate.gateway.scarf.sh/latest/restate-{server,cli}-$RESTATE_PLATFORM.tar.xz in references/local-dev.md. \n- Privilege Escalation (HIGH): Installation instructions in references/local-dev.md suggest using sudo to move downloaded binaries into system-wide execution paths. \n
Evidence: sudo mv restate $BIN && sudo mv restate-server $BIN in references/local-dev.md. \n- Indirect Prompt Injection (HIGH): The skill provides patterns for building stateful handlers that ingest external, untrusted data from webhooks (references/guide-durable-webhooks.md) and Kafka topics (references/invoke-kafka.md). Given that Restate handlers have powerful capabilities like ctx.run (arbitrary code execution) and state management, this creates a significant attack surface if the input data contains malicious instructions. \n
Ingestion points: references/guide-durable-webhooks.md, references/invoke-kafka.md. \n
Boundary markers: Absent. \n
Capability inventory: Durable execution of arbitrary code via ctx.run, durable K/V state access, and external service calls (ctx.serviceClient). \n
Sanitization: Not provided in the documentation templates.

restate