The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides a comprehensive list of commands for offensive security tools such as Nmap, Metasploit, Nikto, SQLMap, and Hydra. These are used for network discovery, vulnerability scanning, and active exploitation of remote systems.
[DYNAMIC_EXECUTION]: Includes instructions for using msfvenom to generate malicious payloads, including reverse shells in various formats like ELF, EXE, PHP, and Python. This allows for the creation of executable code designed to compromise targets.
[PRIVILEGE_ESCALATION]: The skill references the sqlmap --os-shell command, which is a technique used to gain administrative-level access or shell execution on a remote server through database vulnerabilities.
[DATA_EXFILTRATION]: Provides commands for password cracking and database dumping using tools like john the ripper, hydra, and sqlmap. These operations are specifically designed to harvest credentials and extract sensitive information from targets.
[INDIRECT_PROMPT_INJECTION]: The skill defines an attack surface where untrusted data (target IPs and URLs) is directly interpolated into powerful shell commands without sanitization or boundary markers.
Ingestion points: Target IP addresses, URLs, and network interface names defined in the workflow (SKILL.md).
Boundary markers: Absent; there are no delimiters to isolate user-supplied inputs from the command syntax.
Capability inventory: Extensive set of tools for scanning, exploitation, and payload generation (Nmap, Metasploit, SQLMap, msfvenom, Hydra).
Sanitization: None; the skill assumes the user provides valid and authorized targets, but the agent lacks mechanisms to verify or sanitize these inputs before execution.

Pentest Commands