The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill employs a execution pattern where the output of a network request (curl) is piped directly into a Python interpreter (python3). Although the current implementation uses a hardcoded Python script string to process JSON, this pattern is a high-risk execution vector frequently used for remote code execution.
[COMMAND_EXECUTION]: The instructions rely heavily on shell-based tools (curl, sqlmap, nmap, nuclei, ffuf, nc) and local network service instantiation (python3 -m http.server). These tools are used for automated scanning, proxy configuration, and establishing Out-of-Band (OOB) infrastructure.
[EXTERNAL_DOWNLOADS]: The skill fetches dynamic content from external services, specifically geolocation data from ip-api.com and proxy lists from proxyscrape.com, which are then used to influence subsequent command execution.
[INDIRECT_PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by ingesting data from external APIs (proxies and geolocation) and interpolating that data directly into shell commands ({countryCode}, {PROXY_IP:PORT}).
Ingestion points: Data is fetched from ip-api.com and proxyscrape.com via curl.
Boundary markers: None identified in the provided instructions.
Capability inventory: The skill uses curl, python3, sqlmap, nmap, nuclei, ffuf, nc, and manual Python script execution.
Sanitization: There is no explicit sanitization of the values returned by these external services before they are used in commands.
[DYNAMIC_EXECUTION]: The skill provides explicit instructions for 'Tool Bootstrapping' (工具自举), where the agent is told to write and execute its own Python implementations for tasks like port scanning, directory brute-forcing, and exploitation if standard tools are missing from the environment.

proxy-tool-bootstrap