The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes external security tools such as Nmap, SQLMap, and Nuclei via shell commands. This is the primary intended functionality of the DAST automation toolset and is documented across the skill's scripts and workflows.
[EXTERNAL_DOWNLOADS]: The skill's CI/CD workflows and installation guides provide instructions for downloading security scanners and vulnerability templates from well-known and reputable public repositories on GitHub (e.g., ProjectDiscovery).
[PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection because it is designed to crawl and process arbitrary data from target web applications.
Ingestion points: Target website content crawled and monitored by 'playwright_crawler.py' and 'playwright_dast_scanner.py'.
Boundary markers: Not explicitly implemented in the instructions used when the agent reasons about target responses.
Capability inventory: Extensive capabilities including shell command execution (via subprocess), network access, and file system writes.
Sanitization: No explicit sanitization of target content is performed to protect the agent's own instruction context.
[SAFE]: The destructive command examples (e.g., 'rm -rf /') and reverse shell patterns identified by static analysis are contained within technical documentation files as reference payloads for security testing and are not intended for execution on the local host.
[SAFE]: The skill demonstrates secure handling of sensitive data by instructing the agent to read credentials from environment variables and providing mechanisms for rigorous scope and path exclusion.

dast-automation