The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill clones the 'tplmap' tool from an external GitHub repository (github.com/epinna/tplmap) which is not among the verified trusted sources.
[REMOTE_CODE_EXECUTION]: The workflow involves installing dependencies via pip install -r requirements.txt and executing the downloaded Python script (python tplmap.py), which constitutes execution of external code.
[COMMAND_EXECUTION]: Includes a functional bash script (Detection script) that uses curl to automate the testing of multiple SSTI payloads against a provided URL and parameter.
[DATA_EXFILTRATION]: Provides specific RCE payloads designed to leak sensitive environment variables and credentials, such as DATABASE_URL, STRIPE_SECRET_KEY, and JWT_SIGNING_KEY.
[DATA_EXFILTRATION]: Instructs the use of an out-of-band (OOB) service (your-interactsh.oast.fun) to confirm blind SSTI vulnerabilities by triggering external network requests.
[INDIRECT_PROMPT_INJECTION]: The skill ingests external data (URLs and parameters) into a shell script without sanitization. While intended for security testing, this represents an attack surface for indirect injection if the processed data contains malicious control characters.
Ingestion points: URL and PARAM variables in the bash detection script.
Boundary markers: None present in the script.
Capability inventory: Shell execution, curl, git, pip, python.
Sanitization: No escaping or validation is performed on the input parameters before execution.

ssti