The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill references and downloads several well-known security tools and dependencies from trusted registries and official repositories.
Fetches packages like requests, pyjwt, cryptography, and httpx from PyPI.
Refers to established security tools such as sqlmap, nuclei, and ysoserial.
Downloads are directed toward official package managers or well-known vendor resources (e.g., PortSwigger, GitHub).
[COMMAND_EXECUTION]: The provided scripts facilitate the generation and execution of shell commands, primarily for vulnerability probing.
scripts/proto_ssti_gadgets.py and scripts/xss_csp_forge.py generate payloads intended to trigger command execution on a target system.
Scripts use standard Python subprocess calls or requests to interact with external targets.
[PROMPT_INJECTION]: No evidence of prompt injection or attempts to override agent safety guidelines were detected in the instructions or metadata.
[REMOTE_CODE_EXECUTION]: While the skill generates RCE payloads (e.g., for SSTI or Prototype Pollution), it does not contain a mechanism to execute remote code on the local agent's environment itself. The static analysis flags for Base64 execution in scripts/xss_csp_forge.py refer to the generation of base64-encoded XSS payloads for testing, not the execution of obfuscated code within the skill's own runtime.

web-pentest