The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions use the $ARGUMENTS placeholder directly within shell command strings passed to the Bash tool. This pattern is highly susceptible to command injection if user input contains shell metacharacters such as ;, &&, |, or backticks.
Evidence in SKILL.md: dig any $ARGUMENTS, dig axfr @ns-server $ARGUMENTS, whois $ARGUMENTS, and nmap -sC -sV -oN scan-results.txt $ARGUMENTS.
Evidence in SKILL.md: curl -s "https://crt.sh/?q=%25.$ARGUMENTS&output=json". In this instance, unsanitized input could break out of the URL string to execute additional bash commands.
[REMOTE_CODE_EXECUTION]: Due to the command injection vulnerabilities in the shell commands, an attacker could achieve arbitrary code execution on the system running the agent.
[EXTERNAL_DOWNLOADS]: The methodology references multiple external security tools (e.g., testssl.sh, sslyze, gobuster, feroxbuster, dirsearch). While standard in the security industry, these represent unverified external dependencies that the skill assumes are available or can be executed.
[PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection via its data collection features.
Ingestion points: Uses WebSearch and WebFetch to gather external data.
Boundary markers: Absent. The skill does not define delimiters or provide instructions to ignore commands embedded in fetched web content.
Capability inventory: The skill has access to Bash for command execution and Write for file system modification.
Sanitization: Absent. External content is correlated and analyzed in Phase 3 without sanitization or escaping.

recon