The Agent Skills Directory

[COMMAND_EXECUTION]: The skill launches arbitrary MCP server processes using shell commands and arguments defined in local configuration files (.opfor/configs/<uuid>/config.md). This mechanism allows for the execution of any binary or script accessible within the execution environment.
[DATA_EXFILTRATION]: The skill performs comprehensive source code analysis (whitebox) of the target server by resolving source roots and reading files to map tool handlers and identify security sinks. This involves reading local application code which may contain sensitive intellectual property.
[PROMPT_INJECTION]: The skill is exposed to indirect prompt injection vulnerabilities when processing untrusted responses from target MCP servers during the 'Attacker' and 'Judge' phases of execution.
Ingestion points: Untrusted data enters the agent context through MCP server responses captured during attack execution (Step 5) and evaluated for vulnerabilities (Step 6).
Boundary markers: The Attacker and Judge prompts utilize structured delimiters such as 'ATTACK:', 'Server Response:', and 'PREVIOUS TURNS:' to attempt to isolate untrusted content from system instructions.
Capability inventory: The skill possesses capabilities for shell command execution (Step 4), extensive local file system reading (Step 4.5), and file system writing for report generation (Step 7).
Sanitization: Server responses are truncated to a maximum of 2000 characters before being processed by the Judge LLM, providing a basic volume-based constraint but no semantic sanitization.

opfor-mcp-run