The Agent Skills Directory

[COMMAND_EXECUTION]: The skill documents a comprehensive suite of shell commands for security testing, including tools for network scanning (nmap), web endpoint discovery (ffuf, gobuster), and SQL injection verification (sqlmap). These commands are intended to be executed by the agent as part of a security audit workflow.\n- [DATA_EXFILTRATION]: The instructions involve the use of network tools like curl and httpie to interact with target systems. While necessary for the stated purpose of pentesting, these capabilities allow the agent to transmit data to external network endpoints.\n- [EXTERNAL_DOWNLOADS]: The skill references and encourages the use of numerous third-party security utilities, such as Nikto, testssl.sh, Frida, and Objection, which are not bundled with the skill itself.\n- [PROMPT_INJECTION]: The skill is susceptible to Indirect Prompt Injection (Category 8) because it processes data from external, untrusted sources during testing. Ingestion points: Response data from tools like curl, ffuf, and sqlmap (referenced in references/tool-playbook.md). Boundary markers: No explicit instructions are provided to the agent to treat external tool output as untrusted or to ignore embedded commands. Capability inventory: Significant command execution and network access capabilities documented throughout the skill files. Sanitization: No sanitization or validation of the data retrieved from external tools is specified before it is processed by the agent.

active-pentest