The Agent Skills Directory

[DATA_EXFILTRATION]: The skill performs an automated 'Static Source Pre-Scan' by default (Step 3.5), which reads the agent's source code and configuration files. This process ingests local codebase content into the LLM context. Additionally, the skill sends requests to user-defined external 'Target' endpoints, creating a potential path for data exposure if the target is untrusted.
[COMMAND_EXECUTION]: The skill executes external system commands and third-party tools. In Step 3.5c, it probes for and executes 'semgrep' or 'codeql' on the host system. Furthermore, it supports 'custom-function' targets (Step 4), which involve executing arbitrary local scripts or entry points (e.g., 'python eval_safety.py') to test agent behavior.
[CREDENTIALS_UNSAFE]: The execution logic in Step 4 explicitly instructs the agent to retrieve authentication tokens from environment variables, specifically mentioning 'OPENAI_API_KEY', to authenticate HTTP requests sent to external endpoints. This pattern exposes sensitive system credentials to the network requests performed by the skill.
[REMOTE_CODE_EXECUTION]: The skill fetches 'Target Adapters' from a sibling directory ('../opfor-setup/targets/') and executes the logic defined within those files to construct network requests and parse responses (Step 2).
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from multiple sources, including target HTTP responses and JSON trace data from telemetry providers like Langfuse and Netra (Step 5). Because the skill has the capability to read files and execute commands, it presents a significant attack surface for indirect prompt injection if the processed data contains malicious instructions.

opfor-run