The Agent Skills Directory

[COMMAND_EXECUTION]: The tools/harness.py script uses subprocess.run with shlex.split to execute the --target and --oracle commands. While shlex.split mitigates simple shell injection, the skill's setup instructions in SKILL.md rely on the agent to infer or ask for these command strings. If an attacker provides a maliciously crafted command string, it could lead to arbitrary code execution within the agent's environment.
[PROMPT_INJECTION]: The skill's primary purpose is to generate adversarial inputs to test guardrails. While intended for authorized security testing, the Attack toolkit section in SKILL.md explicitly instructs the agent to create payloads involving obfuscation (unicode homoglyphs, encoding), paraphrasing, and context embedding. These are standard techniques used in prompt injection attacks, and the skill provides a structured loop to refine these bypass methods.
[DATA_EXFILTRATION]: While no direct exfiltration was detected, the harness.py script facilitates the reading and writing of arbitrary files specified via CLI arguments (--inputs, --log). In an environment where the agent has access to sensitive files, a maliciously configured loop.run.yaml could be used to read sensitive data as 'candidates' and log them to a user-accessible file.

red-team