The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill integrates several third-party ethical security frameworks and tools, including akto-api-security/akto, 0x4m4/HexStrike-AI, AIPentest/CyberStrikeAI, vxcontrol/pentagi, and GH05TCREW/pentestagent. These tools are orchestrated via adapters to perform automated vulnerability scans and security audits as part of the skill's primary red-teaming purpose.
[COMMAND_EXECUTION]: The skill executes security probes and external CLI tools through a native TypeScript HTTP engine and various tool adapters. It implements environmental safety checks, such as verifying the container engine and prohibiting the use of Colima to ensure stability and security during execution.
[INDIRECT_PROMPT_INJECTION]: The skill contains a dedicated framework for identifying indirect prompt injection vulnerabilities in target applications, particularly within AI and LLM components. It establishes clear ingestion points for untrusted data, defines boundary markers through sandboxing, and inventories capabilities to prevent unauthorized actions during the audit process.
[SAFE]: The skill extensively references and implements Cloudflare's security audit guidelines, providing a highly structured and transparent 6-phase workflow for reconnaissance, hunting, validation, and reporting. The use of these established, well-known security practices for their intended purpose is considered safe.
[SAFE]: Robust safety invariants are enforced throughout the skill, including mandatory sandboxing for target-controlled code, read-only target mounts, and isolation of all network traffic to a loopback namespace. These controls ensure that the auditing process remains non-destructive and contained within the authorized scope.

fable-redteam