The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill references several external security tools hosted on GitHub repositories.
The tool Turbo Intruder is sourced from PortSwigger's official GitHub repository, which is a well-known security research vendor.
The skill also references Raceocat and h2spacex from individual developer repositories (JavanXD and nxenon). These represent non-standard external dependencies that may not undergo the same level of security auditing as established vendor tools.
[DYNAMIC_EXECUTION]: The skill contains functional Python code snippets and templates for performing exploitation attacks.
Section 5 provides scripting templates for use with Turbo Intruder to orchestrate parallel HTTP requests.
Section 9.4 includes a standalone Python script utilizing the h2spacex library to perform HTTP/2 single-packet attacks at runtime.
[INDIRECT_PROMPT_INJECTION]: The skill involves processing data from external, untrusted web applications, which presents an attack surface for indirect prompt injection.
Ingestion points: Target web application responses and observed application state transitions described in the testing sections of SKILL.md.
Boundary markers: The skill includes high-level instructions to focus on specific business operations and an "Authorized testing only" advisory.
Capability inventory: The agent is provided with templates for high-concurrency network requests and custom script execution.
Sanitization: There are no explicit validation or sanitization steps defined for the data returned from target applications before the agent evaluates the testing outcomes.
[COMMAND_EXECUTION]: The skill provides detailed instructions and code for executing high-concurrency HTTP requests and utilizing specialized CLI tools to interact with target systems.

race-condition