The Agent Skills Directory

[PROMPT_INJECTION]: The skill explicitly mandates an 'unlimited-attack-scope' (不设限原则) and instructs the agent to 'not pre-set fixed paths/roles/known exploit chains.' This represents a directive to ignore standard safety constraints and operational boundaries in favor of autonomous offensive actions.
[COMMAND_EXECUTION]: The framework defines 'Mandatory Behavior Triggers' (强制行为触发器) that instruct the agent to execute full command sequences from associated skills (e.g., '执行 component-vuln-intel 全部命令') for vulnerability assessment and tool bootstrapping ('proxy-tool-bootstrap').
[PRIVILEGE_ESCALATION]: The skill map includes components specifically designed for 'post-exploitation/privilege escalation' (提权) and 'credential cracking' (凭据破解), indicating a core capability for unauthorized privilege acquisition.
[INDIRECT_PROMPT_INJECTION]: The agent is designed to perform autonomous reconnaissance and intelligence gathering (via attack-surface-recon and component-vuln-intel), which involves processing untrusted data from external targets.
Ingestion points: Target intelligence, network reconnaissance data, and identified service metadata processed by linked skills.
Boundary markers: None identified in the framework index or instructional logic.
Capability inventory: Full-chain attack capabilities, binary reversing, privilege escalation, and 0day discovery mechanisms across the suite.
Sanitization: There are no instructions for sanitizing or validating content retrieved from external targets before processing it through the LLM.

pentest-agent-os