The Agent Skills Directory

[PROMPT_INJECTION]: The skill includes explicit instructions to override standard safety and confirmation patterns. Evidence includes directives such as "Do not insert mid-engagement permission gates", "AskUserQuestion mid-loop... is a stall, not a check", and "Inserting AskUserQuestion at any decision point inside an active engagement loop... does not require user pre-approval." These instructions attempt to bypass the agent's internal safety mechanisms and reduce human oversight during sensitive operations.
[COMMAND_EXECUTION]: The skill encourages the use of shell commands for tool installation and environment setup. Evidence in SKILL.md mentions commands like brew install jadx and apt install. When combined with the instructions to maintain high autonomy and skip user questions, this increases the risk of unauthorized software installation or system modification.
[PROMPT_INJECTION]: Indirect Prompt Injection surface analysis:
Ingestion points: The skill is designed to ingest and process data from various external sources including robots.txt, sitemap.xml, JavaScript bundles, API response bodies, and decompiled mobile application source code (as described in SKILL.md).
Boundary markers: There are no instructions for the agent to use boundary markers or to ignore potential instructions embedded within the target data.
Capability inventory: The agent is directed to use capabilities for network probing, tool installation (brew, apt), and writing to local files (e.g., the "engagement journal" described in SKILL.md).
Sanitization: There is no evidence of data sanitization or validation protocols for content retrieved from external targets.

redteam-mindset