The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: Fetches the Known Exploited Vulnerabilities (KEV) catalog from CISA's official government website (cisa.gov) to enrich scan findings. This is a standard practice using a well-known public service.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from network scan results and interpolates it into ServiceNow incident tickets and reports, creating a surface for indirect prompt injection if target services return malicious data.
Ingestion points: Results from nmap scans and Nessus API exports processed in scripts/agent.py and SKILL.md.
Boundary markers: Absent; data is interpolated directly into report strings and ticket descriptions.
Capability inventory: Includes network operations (ServiceNow API, Nessus API) and local file writing.
Sanitization: No explicit sanitization or validation of the scan results is performed before use.
[COMMAND_EXECUTION]: The agent script executes the nmap binary via the python-nmap library, using service detection and vulnerability scanning scripts (vulners, vulscan) against user-specified targets.
[NETWORK_SECURITY]: The skill includes logic in SKILL.md and scripts/agent.py to disable TLS/SSL certificate verification if the SKIP_TLS_VERIFY environment variable is set. While intended for lab environments with self-signed certificates, this configuration can expose the agent to man-in-the-middle (MITM) attacks if misused in production.

building-vulnerability-scanning-workflow