The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/agent.py performs active network interactions with a target API, including state-changing operations like POST, PUT, and DELETE requests. These actions are used to test for Broken Function Level Authorization (BFLA) and Mass Assignment vulnerabilities.
[EXTERNAL_DOWNLOADS]: The skill makes network requests to external API endpoints provided via the --base-url argument to conduct security assessments.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data retrieved from external API responses.
Ingestion points: API response bodies are parsed in scripts/agent.py (e.g., test_mass_assignment and test_excessive_data_exposure) to verify vulnerability triggers.
Boundary markers: The skill does not implement specific delimiters or warnings to ignore instructions that might be embedded in the API responses.
Capability inventory: The script performs network operations and writes a JSON report to the local filesystem.
Sanitization: External content is parsed as JSON, but there is no explicit sanitization to prevent potential instruction injection if the response data is subsequently processed by the LLM.
[METADATA_POISONING]: There is an inconsistency in the skill's authorship metadata. The SKILL.md frontmatter identifies the author as "mahipal," whereas the LICENSE file contains a copyright notice for "mukul975."

conducting-api-security-testing