The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The assets/ci-config-template.yml file includes a template for a CI pipeline that installs the tfsec tool by fetching and executing its official installation script directly from the repository using the curl | bash pattern.
[COMMAND_EXECUTION]: The skill facilitates the execution of the nikto security tool and ancillary CLI utilities like grep and xmlstarlet for managing scan operations and processing results.
[EXTERNAL_DOWNLOADS]: The automation assets within the skill reference and download several security-focused packages and tools from public registries and official project repositories, including semgrep, safety, checkov, and tfsec.
[PROMPT_INJECTION]: The skill parses and summarizes output from external security scanners, which creates a surface for indirect prompt injection where data from scanned targets could potentially influence the agent's reporting logic.
Ingestion points: Scan result data is ingested from files such as nikto_report.xml and other tool-generated artifacts in SKILL.md and assets/ci-config-template.yml.
Boundary markers: The skill does not employ explicit delimiters or instructions to the agent to ignore potentially malicious embedded content within scanner outputs.
Capability inventory: The skill possesses the capability to execute shell commands, perform file system operations, and control CI/CD pipeline flow based on ingested data.
Sanitization: There is no evidence of sanitization or rigorous validation of the data extracted from tool reports before it is utilized in subsequent steps.

webapp-nikto