The Agent Skills Directory

[COMMAND_EXECUTION]: The skill's methodology relies on executing various security auditing tools and utilities via the Bash interface (e.g., curl, sqlmap, nuclei, sslyze). These tools are used within a structured penetration testing context and the skill emphasizes the importance of rate-limiting and avoiding destructive behavior.
[PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface because it fetches and analyzes data from external web applications using WebFetch and WebSearch. Malicious content on a target site could theoretically attempt to influence the agent's logic.
Ingestion points: Untrusted data enters the agent context via WebFetch and WebSearch results described in Phase 1 and Phase 6 of SKILL.md.
Boundary markers: Explicit boundary markers or instructions to ignore embedded commands in target data are absent.
Capability inventory: The skill uses Bash for command execution, Write for report generation, and Read for file access.
Sanitization: There is no mention of sanitizing or escaping the data retrieved from external targets before the agent processes it.

web-pentest