The Agent Skills Directory

[COMMAND_EXECUTION]: The skill relies heavily on executing external shell commands to perform its functions. It utilizes a variety of security tools including dnsx, httpx, nuclei, katana, feroxbuster, ffuf, whatweb, and wpscan. The references/command-playbook.md provides templates for these executions, which are carried out by the agent to probe network targets and process output.
[PROMPT_INJECTION]: The skill possesses a significant indirect prompt injection surface as it is designed to crawl, parse, and analyze untrusted content from remote web servers.
Ingestion points: Web application responses, first-party JavaScript files, API schemas (Swagger/OpenAPI), and directory listing results captured in raw/ and normalized/ directories.
Boundary markers: The skill does not define specific delimiters or instructions to prevent the agent from interpreting ingested web content as new commands or behavioral overrides.
Capability inventory: The agent has broad shell access to execute numerous network-active tools and file-system write capabilities to manage the workspace.
Sanitization: While the skill performs technical deduplication and normalization into JSONL formats, it lacks semantic sanitization to isolate untrusted data from the agent's instructional context.
[CREDENTIALS_UNSAFE]: The skill instructions explicitly direct the agent to read local files such as creds.txt to acquire credentials for authorized scanning. While this is standard practice for the skill's stated purpose of penetration testing, it involves the handling of potentially sensitive plaintext credentials from the local file system.

pentest-web-enumeration