The Agent Skills Directory

[COMMAND_EXECUTION]: The execute_command function in references/tools.md allows the agent to run arbitrary shell commands. This is a high-privilege capability intended for executing standalone pentesting tools not explicitly defined as MCP endpoints.
[DYNAMIC_EXECUTION]: Several tools, including pwntools_exploit, gdb_analyze, and angr_symbolic_execution, allow the agent to generate and execute custom scripts or command sequences. This facilitates the complex logic required for exploit development and symbolic analysis.
[INDIRECT_PROMPT_INJECTION]: The skill's primary function involves ingesting and analyzing untrusted external data (binaries, firmware, and libc files).
Ingestion points: Tools such as strings_extract, ghidra_analysis, and radare2_analyze (in references/tools.md) read content from files provided by the user or target environment.
Boundary markers: The instructions do not define delimiters or specific constraints to prevent the agent from interpreting strings or metadata within the binaries as instructions.
Capability inventory: The agent has significant capabilities, including network access for libc lookups and local command execution, which could be abused if an injection is successful.
Sanitization: There is no evidence of sanitization or filtering of the binary content before it is processed by the agent's reasoning engine.

pentest-ctf-binary