The Agent Skills Directory

[SAFE]: The skill is a legitimate security testing toolset. It does not contain malicious instructions, data exfiltration logic, or unauthorized access attempts against the agent's host environment.\n- [DYNAMIC_EXECUTION]: Several files (e.g., scripts/proto_ssti_gadgets.py, references/ssti-deserialization.md) contain or generate code execution payloads (e.g., Jinja2, Node.js RCE). These are clearly documented as offensive security payloads intended to be sent to remote targets for vulnerability validation and do not execute within the agent's local context.\n- [OBFUSCATION]: The skill uses Base64 encoding in specific contexts, such as atob('YWxlcnQoMSk=') in scripts/xss_csp_forge.py. These instances are correctly identified as XSS payload examples for testing web filters and do not represent attempts to hide the skill's own code or intent. It also documents obfuscation techniques (like Cyrillic homoglyphs) for the purpose of WAF evasion testing.\n- [EXTERNAL_DOWNLOADS]: The skill relies on standard Python libraries (requests, httpx, pyjwt, cryptography) which are well-known and widely used in the security community for network communications and cryptographic operations. No unverified or remote code is executed by the skill scripts.

web-pentest