The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill downloads and installs an external software package named 'clearwing' using the command uv tool install clearwing. The source repository mentioned is https://github.com/Lazarus-AI/clearwing.
[COMMAND_EXECUTION]: The skill makes extensive use of shell commands to manage its lifecycle and perform scanning tasks:
Installation: uv tool install clearwing.
Configuration: clearwing setup.
Scanning: clearwing sourcehunt, clearwing scan, and clearwing parallel.
System checks: command -v clearwing.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data which could lead to indirect prompt injection vulnerabilities.
Ingestion points: Data is ingested through source code analysis (clearwing sourcehunt <path-to-repo>) and network scanning (clearwing scan <target-ip-or-hostname>).
Boundary markers: The skill includes a manual authorization check for the user to confirm target ownership, but lacks specific delimiters or instruction-ignore markers for the data being analyzed at the prompt level.
Capability inventory: The skill has access to the Bash, Read, Write, Grep, and Glob tools, which allow it to execute shell commands and modify the file system.
Sanitization: No explicit sanitization or filtering logic is provided in the skill instructions for the ingested code or network responses.

pentest