The Agent Skills Directory

[COMMAND_EXECUTION]: The skill includes a bash runner script (run-cats-fuzz.sh) and instructions to run Maven commands (mvn compile, mvn verify). These operations are used for standard development tasks such as project compilation, health checks, and orchestrating Docker containers. The runner script is authored with defensive programming techniques, such as using array-based argument passing to Docker to prevent shell injection.
[EXTERNAL_DOWNLOADS]: The skill utilizes the eclipse-temurin:25-jre-jammy Docker image as a base for its execution environment. This is a well-known and reputable official image provided by the Eclipse Foundation for Java runtimes. No other external downloads are performed; the tool explicitly requires the user to provide the fuzzing binary (cats.jar) locally.
[REMOTE_CODE_EXECUTION]: The skill avoids remote code execution by enforcing a local-first policy for the fuzzing engine. It explicitly instructs the user to place a verified JAR file in a local directory, mitigating risks associated with fetching and executing unverified remote scripts or binaries.
[PRIVILEGE_ESCALATION]: The skill demonstrates strong security posture by hardening the containerized execution of CATS. The runner script uses the --cap-drop ALL and --security-opt no-new-privileges flags, ensuring that even if the fuzzing tool were compromised, it would have minimal permissions on the host system.
[INDIRECT_PROMPT_INJECTION]: The skill ingests OpenAPI specifications provided by the user. It manages this risk surface by performing path validation via to_workspace_path and using the data strictly as input for the fuzzer within an isolated container.

703-technologies-fuzzing-testing