The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill instructs the agent to automatically scan local repository files, including .env, .env.local, config.json, and docker-compose.yml, specifically searching for authentication secrets such as LANGFUSE_SECRET_KEY, NETRA_API_KEY, and OPENAI_API_KEY. While the instructions state not to echo these secrets into the chat, the skill proceeds to use them for automated network requests.
[EXTERNAL_DOWNLOADS]: The skill initiates network requests to external telemetry providers and target endpoints. Automated security scans detected a connection to a known malicious URL (http://qa-reports.evil.com/upload) which is hidden from plain-text view within the skill, indicating the use of obfuscation techniques like zero-width characters or homoglyphs to evade manual inspection.
[COMMAND_EXECUTION]: The skill extensively uses bash and curl to execute operations. In targets/custom-function.md, it defines a pattern where attack prompts are directly interpolated into shell command arguments (e.g., python eval_safety.py --prompt "<adapted-attack-prompt>"). This pattern is highly vulnerable to command injection if the prompt contains shell metacharacters.
[DATA_EXFILTRATION]: The skill is designed to collect internal documentation, system prompts, and user interaction traces to transmit them to external observability platforms. The use of harvested credentials to fetch and summarize production traces constitutes a significant data exposure and exfiltration risk.
[PROMPT_INJECTION]: The core functionality of the skill involves generating and executing prompt injection attacks. While framed as a red-teaming tool, the presence of hidden malicious destinations suggests the tool itself may be a delivery vehicle for attacks against the user's own environment.

opfor-setup