The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill clones a repository from an unverified source: https://github.com/KHenryAegis/Pentest-R1.git. It also installs a specific git commit of the unsloth library directly from GitHub.
[COMMAND_EXECUTION]: The skill instructs the agent to execute several Python scripts such as grpo_stage1.py and grpo_multi_turn_stage2.py, along with shell commands to build and run Docker containers.
[COMMAND_EXECUTION]: The CTFEnvironment class utilizes container.exec_run(command) to execute shell commands. In the evaluate_on_ctf_challenges loop, these commands are generated dynamically by the LLM based on environment observations, which allows for the execution of arbitrary model-generated code.
[DATA_EXFILTRATION]: The recommended Docker configuration uses the --net=host flag. This grants the container full access to the host machine's network stack, which could be exploited by the model to interact with local network services or exfiltrate data from the host environment.
[PROMPT_INJECTION]: The skill implements an autonomous loop that is vulnerable to indirect prompt injection.
Ingestion points: External data enters the context via env.execute_command("cat /challenge/description.txt") within the evaluate_on_ctf_challenges function in SKILL.md.
Boundary markers: The _build_prompt method lacks delimiters or instructions to isolate untrusted observation data from the system instructions.
Capability inventory: The skill possesses shell execution capabilities via container.exec_run in the CTFEnvironment class.
Sanitization: There is no evidence of command validation or sanitization before the LLM-generated strings are executed in the shell.

pentest-r1-autonomous-penetration-testing