The Agent Skills Directory

[DYNAMIC_EXECUTION]: The mitmproxy_intercept tool, defined in references/tools.md, includes a modify_fn parameter. This parameter is intended to receive a Python function string to be applied to matching network flows, which facilitates the dynamic execution of code at runtime.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to interact with and process data from untrusted external web applications, creating an attack surface for indirect prompt injection.
Ingestion points: Data from external targets enters the agent's context through tools like burp_repeater, burp_intruder, mitmproxy_intercept, and playwright_workflow (which logs network requests) as defined in references/tools.md.
Boundary markers: The instructions in SKILL.md and references/workflows.md do not specify delimiters or guidelines to distinguish between trusted instructions and untrusted data received from target responses.
Capability inventory: The skill possesses extensive system capabilities that could be targeted by an injection, including executing dynamic code (mitmproxy_intercept), writing files (generate_polyglot), and performing network operations (python_requests_workflow).
Sanitization: There is no evidence of sanitization, filtering, or validation of the external content before it is processed by the agent.
[DATA_EXFILTRATION]: The skill defines tools that enable reading local files (upload_file) and tools for making arbitrary network requests (python_requests_workflow, aiohttp_parallel). This combination provides the necessary primitives for data exfiltration if the agent is directed to sensitive local paths.
[COMMAND_EXECUTION]: The skill utilizes wrappers for external security tools, including Burp Suite, mitmproxy, and Playwright, which involve executing subprocesses on the host system as described in references/tools.md.

pentest-business-logic