The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides shell command templates for the Hydra security tool to perform brute-force attacks against web authentication forms.
Evidence: Phase 4 and Example 1 include command-line strings for executing hydra with specified target and wordlist parameters.
[DATA_EXFILTRATION]: The skill contains a Python script that automates network requests to external domains, which could be used to interact with third-party servers.
Evidence: Phase 6 includes a Python script utilizing the requests.get method to programmatically fetch data from a target URL.
[PROMPT_INJECTION]: The skill presents an indirect prompt injection attack surface as it is designed to process untrusted external data using powerful capabilities.
Ingestion points: Untrusted data enters the agent context via the 'Target application URL' and 'Test account credentials' defined in the Prerequisites.
Boundary markers: Absent; there are no instructions or delimiters provided to prevent the agent from obeying instructions embedded within the target application data.
Capability inventory: The skill utilizes network request capabilities via the Python requests library (Phase 6) and local command execution for the hydra tool (Phase 4).
Sanitization: Absent; the skill does not specify any validation or sanitization routines for the external URL or credential inputs before they are used in commands or scripts.

Broken Authentication Testing