The Agent Skills Directory

[COMMAND_EXECUTION]: The skill defines and utilizes wrappers for several powerful offensive command-line tools. Evidence includes:
sqlmap_exploit in references/tools.md for automated SQL injection.
nuclei_validate in references/tools.md for automated vulnerability scanning.
curl_exploit in references/tools.md for manual HTTP request crafting and manipulation.
The bypass_exhaustion protocol in SKILL.md and references/workflows.md instructs the agent to persist in attempting to circumvent security controls using these tools.
[DATA_EXFILTRATION]: The skill is explicitly designed to perform data exfiltration as part of its validation process. Evidence includes:
Instructions in SKILL.md to "demonstrate data exfiltration with minimal footprint."
SSRF exploitation workflows in references/workflows.md targeting the cloud metadata endpoint (169.254.169.254/latest/meta-data/).
XSS exploitation workflows in references/workflows.md designed to "capture document.cookie via injected payload."
SQL injection workflows in references/workflows.md designed to "Extract database names, table names, column names" and exfiltrate rows.
[INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it processes untrusted external data to drive its high-privilege exploitation tools. Evidence Chain:
Ingestion points: The skill ingests an external exploitation_queue JSON in SKILL.md (Queue Intake) and references/workflows.md (exploitation_queue_schema).
Boundary markers: No delimiters or instructions to ignore embedded commands are present in the processing logic.
Capability inventory: The skill has access to sqlmap, curl, nuclei, and playwright, enabling network access and shell command execution.
Sanitization: There is no mention of sanitizing or validating the contents of the source_param, endpoint, or bypass_hypothesis fields before they are passed to the exploitation tools.
[DYNAMIC_EXECUTION]: The skill facilitates the execution of dynamic content at runtime. Evidence includes:
The turbo_intruder function in references/tools.md accepts a payload_generator parameter, which is described as a "Python script for payload generation" that the agent is expected to execute.
The playwright_xss function in references/tools.md executes arbitrary JavaScript payloads within a browser context to capture evidence.

pentest-exploit-validation