The Agent Skills Directory

[DATA_EXFILTRATION]: The skill's reconnaissance workflow and command catalog (references/recon-commands.md) explicitly direct the agent to locate and read sensitive files, including .env files and configurations containing secrets like AWS access keys. While the skill instructs the agent not to record secret values in the final report, the act of reading these files exposes sensitive information to the agent's context.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from the project codebase and incorporates it into a generated pentest plan. The lack of boundary markers or input sanitization, combined with the agent's access to the Bash tool, creates a surface for indirect prompt injection where malicious content in the scanned files could attempt to execute unauthorized shell commands.
Ingestion points: Project codebase files read via the Glob, Grep, and Read tools during reconnaissance.
Boundary markers: None identified in the prompt instructions or output templates to separate untrusted data from agent instructions.
Capability inventory: Bash tool (shell command execution), file system read/write access (Read, pentest-plan.md), and file discovery (Glob, Grep).
Sanitization: The skill includes instructions to exclude secret values from the output but lacks mechanisms to sanitize content for potential instruction injection attacks.

security-pentest-planner