The Agent Skills Directory

[PROMPT_INJECTION]: The skill contains 'CRITICAL RULES' and 'THE ONLY QUESTION THAT MATTERS' sections that use strong, imperative language to override the agent's typical behavior and priorities. Additionally, the skill explicitly discusses and provides techniques for 'System prompt extraction' and bypassing safety filters in other AI systems, which presents a risk of the agent applying these techniques to itself or being influenced by them.
[EXTERNAL_DOWNLOADS]: The skill provides instructions to download and install a large number of third-party security tools (e.g., sqlmap, ffuf, nuclei, trufflehog) from external repositories. The installation section for the skill itself uses curl to fetch content from a GitHub repository (shuvonsec/claude-bug-bounty) that is not owned by the stated author (gsfsss), raising concerns about the integrity and source of the code.
[REMOTE_CODE_EXECUTION]: The skill documents and provides functional code snippets for achieving Remote Code Execution (RCE) via various vectors, including Server-Side Template Injection (SSTI) in multiple languages (Python, PHP, Java, Ruby), shell injection in Python and PHP, and exploitation of Node.js sinks. It also targets CI/CD pipelines for code injection vulnerabilities.
[DATA_EXFILTRATION]: The skill provides detailed instructions and commands for harvesting sensitive data, such as AWS/GCP/Azure cloud credentials, environment variables, and private keys. It includes specific commands using curl to exfiltrate discovered secrets to external attacker-controlled endpoints.
[COMMAND_EXECUTION]: The core functionality of the skill is centered on instructing the agent to execute a wide array of reconnaissance and exploitation tools in a local shell environment, often with parameters derived from untrusted external input.
[PRIVILEGE_ESCALATION]: The skill includes methodologies for privilege escalation, such as bypassing authentication, exploiting IDOR vulnerabilities to reach administrative functions, and performing container escapes (e.g., via privileged Docker mounts).
[INDIRECT_PROMPT_INJECTION]: The skill's primary workflow involves processing untrusted external data (e.g., web pages, documents, API responses). It explicitly acknowledges and provides techniques for 'Indirect injection', which creates a significant attack surface if the agent processes malicious instructions embedded in the data it is analyzing.

bb-local-toolkit