The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes local commands using subprocess.Popen to probe Model Context Protocol (MCP) servers over stdio. This functionality is restricted by a strict allowlist of permitted package runners (npx, uvx, python3, python, node, bunx) and blocks the use of absolute paths to prevent unauthorized binary execution.
[REMOTE_CODE_EXECUTION]: Implements defensive regex patterns to detect and block inline code execution flags (such as -c, --eval, or --exec) in subprocess arguments, mitigating risks of command injection from untrusted input strings.
[DATA_EXFILTRATION]: Performs network requests to discover API surfaces. It includes built-in SSRF (Server-Side Request Forgery) protection using the ipaddress module to block access to private, loopback, and cloud metadata IP ranges. Additionally, it uses a custom HTTP handler to disable redirects, preventing redirect-based SSRF attacks.
[SAFE]: The skill incorporates comprehensive scrubbing logic to redact sensitive information from generated reports, including masking Authorization headers, Set-Cookie values, and API-Key headers, while scanning response bodies for token-like patterns. The codebase further demonstrates high security maturity through environment variable scrubbing for subprocesses and response body size capping to prevent memory-based Denial of Service.

endpoint-probe