The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes command-line tools such as curl for manual CORS verification and python -m http.server for hosting proof-of-concept pages during testing.
[EXTERNAL_DOWNLOADS]: The skill references several external tools and libraries commonly used in security research, including CORScanner, websocket-client, Playwright, and Puppeteer.
[INDIRECT_PROMPT_INJECTION]: The skill represents an indirect injection surface as it ingests and processes untrusted data from external URLs.
Ingestion points: Tools like postmessage_scanner, storage_inspector, and corscanner_scan (SKILL.md, references/tools.md) process content from target URLs.
Boundary markers: None explicitly defined in the instructions to separate target data from agent instructions.
Capability inventory: Network requests via curl and websocket-client, browser automation via Playwright, and file-writing capabilities through PoC generation functions (references/tools.md).
Sanitization: No specific sanitization or validation logic is described for the content retrieved from external sources.
[DYNAMIC_EXECUTION]: The skill employs browser automation frameworks (Playwright and Puppeteer) to dynamically execute JavaScript and interact with web pages to verify client-side vulnerabilities like clickjacking and postMessage abuse.

pentest-client-advanced