The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses shell commands to run network diagnostic tools and exploitation scripts, including curl, smuggler, and h2csmuggler. These tools are executed with parameters derived from the target environment, which can pose a risk if input is malformed or maliciously crafted.
[EXTERNAL_DOWNLOADS]: It encourages the installation of the smuggler Python package using pip without specifying a version or verifying the source. This practice exposes the environment to supply chain attacks or typosquatting if a malicious package is published to the public registry.
[DATA_EXFILTRATION]: The instructions direct the agent to actively capture and store sensitive information discovered during the attack, specifically naming files like ssrf-aws-creds.json and sqli-users-dump.txt. This involves the systemic collection of session tokens and cloud credentials from third-party traffic.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection as it processes raw HTTP traffic (headers and request bodies) from external sources. An attacker could craft a response or a smuggled request containing malicious instructions intended for the agent to execute.
Ingestion points: Target HTTP headers (Server, Via, X-Cache) and captured victim request content in Step 5.
Boundary markers: Absent; the instructions do not use delimiters or warnings to treat captured traffic as untrusted data.
Capability inventory: File writing (saving evidence), network operations (curl), and command execution (python/bash).
Sanitization: None; the skill captures and saves raw external content verbatim.

request-smuggling