The Agent Skills Directory

[COMMAND_EXECUTION]: The skill includes several scripts (pentest.py, rank_files.py, finalize.py) that utilize subprocess.run to execute system commands.
pentest.py acts as a wrapper for industry-standard security tools such as nmap, nikto, nuclei, and gobuster to perform active scanning.
rank_files.py executes git diff to programmatically identify changed files for targeted security reviews.
These calls use list-based argument passing (shell=False by default), which significantly mitigates common command injection vulnerabilities.
[EXTERNAL_DOWNLOADS]: The pentest.py script performs network operations to fulfill its auditing requirements.
It queries crt.sh (a well-known Certificate Transparency log service) for passive subdomain reconnaissance.
It performs active network probing and HTTP requests against user-specified targets to identify services and vulnerabilities.
The documentation includes clear instructions for the AI agent to seek explicit user authorization before interacting with any non-local (remote) targets.
[DYNAMIC_EXECUTION]: The scripts/pentest.py utility uses the __import__ function. Analysis of the code confirms this is used for feature detection—specifically to check for the presence of optional Python dependencies like dnspython or python-whois—rather than executing untrusted code strings.
[DATA_EXPOSURE]: While the tool is designed to identify sensitive data exposure within a target codebase, the skill itself does not contain patterns for exfiltrating the host's credentials or sensitive local files to unauthorized third-party servers.
[PROMPT_INJECTION]: The skill includes extensive 'steering' documentation that defines clear boundaries and methodologies. It specifically implements an 'adversarial validation' phase where a separate agent instance attempts to disprove findings, which serves as a mitigation against indirect prompt injection (e.g., malicious instructions hidden in the files being audited).

security-specialist