The Agent Skills Directory

[DYNAMIC_EXECUTION]: The code snippets provided for extending the toolkit use unsafe methods for rendering data. Specifically, the displayVulnerabilitiesPaginated function uses .innerHTML to render vulnerability titles and details from localStorage without sanitization. Similarly, the generateCustomReport function uses document.write to generate HTML reports from stored data. These patterns are vulnerable to Cross-Site Scripting (XSS) as they can execute arbitrary JavaScript if the stored data is compromised.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process vulnerability reports and checklists, creating an attack surface for indirect injection. If the data being processed (e.g., a vulnerability description from an external website or an imported JSON file) contains malicious payloads, it could be rendered by the toolkit's UI. Ingestion points: localStorage populated by functions like trackVulnerability, initializeEngagement, or importData. Boundary markers: No delimiters or warnings are present in the provided code to distinguish between data and instructions. Capability inventory: The skill can generate and download files (JSON exports) and render content in the browser context via the toolkit interface. Sanitization: No sanitization or escaping is performed before rendering data into the DOM using methods like innerHTML or document.write.
[UNVERIFIABLE_DEPENDENCIES_AND_REMOTE_CODE_EXECUTION]: The installation instructions direct the user to clone a repository from github.com/Cyber-Autopsie/PenTest-Toolkit-Pro.git and run a local HTML file. This repository belongs to the project's developer.

pentest-toolkit-pro-html