The Agent Skills Directory

[DATA_EXFILTRATION]: The script scripts/live_intercept.py intercepts HTTP login requests and captures plaintext user emails and passwords, writing them to the local file /tmp/captured_credentials.json.
[DATA_EXFILTRATION]: scripts/pii_extractor.py forges authentication tokens to harvest sensitive user data, including names, phone numbers, and precise vehicle location coordinates, saving the results to /tmp/extracted_pii.json.
[DATA_EXFILTRATION]: The scripts/burp_equivalent.py addon logs the full history of intercepted HTTP traffic, including sensitive request bodies and authentication headers, to /tmp/proxy_history.json.
[COMMAND_EXECUTION]: scripts/live_intercept.py contains logic to automatically modify outgoing HTTP request bodies to inject destructive SQL payloads (e.g., DELETE FROM applied_coupon...) and manipulate business logic parameters such as product quantities.
[REMOTE_CODE_EXECUTION]: The installation guidelines in README.md and SKILL.md instruct users to download and execute a remote shell script from astral.sh by piping it directly into the system shell (curl -LsSf https://astral.sh/uv/install.sh | sh).
[CREDENTIALS_UNSAFE]: Several scripts (scripts/live_intercept.py, scripts/pii_extractor.py, scripts/jwt_forge.py) contain a hardcoded cryptographic secret (jwt_secret = "crapi") used for generating forged authentication tokens.
[EXTERNAL_DOWNLOADS]: The skill fetches the uv package manager installation script from astral.sh and downloads security tools from established repositories such as projectdiscovery and sqlmapproject.

casperpro