The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute shell-based security tools for application scanning.
Specifically, it provides a docker run command to launch the owasp/zap2docker-stable container for full web scans and authentication handling.
It also provides commands for the nuclei CLI to perform template-based vulnerability probing against defined targets.
[EXTERNAL_DOWNLOADS]: The skill relies on external software and configuration data.
It downloads the owasp/zap2docker-stable container image from Docker Hub, which is an official repository for the OWASP Zed Attack Proxy.
It references the use of external Nuclei templates for vulnerability detection, which are typically retrieved from public repositories.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it processes results from external target interactions.
Ingestion points: The agent is directed to "Analyze and Classify Findings" by reading tool-generated reports such as zap-report.json and nuclei-results.json (SKILL.md).
Boundary markers: There are no instructions to use specific delimiters or markers to isolate the report content from the agent's internal reasoning or system instructions.
Capability inventory: The skill utilizes subprocess execution for Docker and Nuclei and performs network operations against specified target URLs (SKILL.md).
Sanitization: The instructions do not include steps for sanitizing or validating the data extracted from external reports before it is processed by the agent.

dynamic-application-security-testing