The Agent Skills Directory

[COMMAND_EXECUTION]: The bundled script scripts/generate_payloads.py contains a generate_script method that accepts arbitrary strings from the --content command-line argument and writes them into a new shell script file. The utility then executes chmod 755 on the resulting file to make it executable, which facilitates the creation and execution of arbitrary shell code.
[PROMPT_INJECTION]: The skill is designed to ingest and parse untrusted data from API specifications (OpenAPI, GraphQL, Protobuf) to automate its fuzzing operations, presenting an indirect prompt injection risk. 1. Ingestion points: SKILL.md instructs the agent to find and read API specification files (e.g., **/openapi.yaml) using the Glob and Read tools. 2. Boundary markers: The instructions do not define any delimiters or ignore-embedded-instruction markers for the parsed content. 3. Capability inventory: The skill has access to Write, Edit, and Bash (restricted to the test:fuzz-* prefix) tools, alongside the script generation utility in scripts/generate_payloads.py. 4. Sanitization: There are no instructions for sanitizing or validating the data extracted from the specifications before it is used to influence the testing logic.

fuzzing-apis