The Agent Skills Directory

[COMMAND_EXECUTION]: The skill is designed to execute network scanning and security assessment commands. The scripts/agent.py file automates the use of nmap via the python-nmap library, while the SKILL.md instructions detail the use of various tools including Metasploit, Hydra, and Impacket for security validation tasks.\n- [INDIRECT_PROMPT_INJECTION]: The skill possesses a potential attack surface for indirect prompt injection through its ingestion of external network data.\n
Ingestion points: Raw service banners, version strings, and Nmap Scripting Engine (NSE) outputs are collected from target hosts by scripts/agent.py.\n
Boundary markers: The data is structured in a JSON report, but no explicit delimiters or instructions are provided to an AI agent to treat these specific fields as untrusted content when analyzing the results.\n
Capability inventory: The skill provides significant network interaction and exploitation capabilities that could be misused if malicious instructions are processed from a compromised service banner.\n
Sanitization: The script does not perform filtering or sanitization of the strings retrieved from network services before they are included in the findings report.\n- [EXTERNAL_DOWNLOADS]: The workflow in SKILL.md instructs the user to download and utilize third-party scripts like linpeas.sh and winPEAS.exe from external repositories for privilege escalation during the testing process.

conducting-network-penetration-test