The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides detailed instructions for executing various security reconnaissance and exploitation tools.
Evidence: Commands for theHarvester, dig, gophish, and evilginx2 are provided in SKILL.md to automate targets profiling and campaign execution.
[EXTERNAL_DOWNLOADS]: The skill references and installs several external dependencies and security tools.
Evidence: The scripts scripts/agent.py and scripts/process.py require the requests library. SKILL.md and references/api-reference.md provide instructions for installing GoPhish, Evilginx2, and the Social Engineer Toolkit (SET) from their respective repositories.
[INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection by ingesting untrusted data from external OSINT sources and phishing campaign responses.
Ingestion points: External data enters the context via theHarvester results (email/names), social media scraping, and GoPhish API campaign results.
Boundary markers: Absent. The skill processes raw data from these tools into markdown reports without explicit sanitization steps mentioned in the prompts.
Capability inventory: The skill has the capability to execute shell commands (subprocess via user instructions) and perform network operations via requests in the Python scripts.
Sanitization: Absent. The scripts focus on parsing JSON responses from the GoPhish API for metric calculation.
[DATA_EXPOSURE]: The provided Python scripts (scripts/agent.py and scripts/process.py) disable SSL certificate verification when interacting with the GoPhish API.
Evidence: requests.packages.urllib3.disable_warnings() and verify=False are used in both scripts. While common in local testing environments for security tools, this is a violation of security best practices.

conducting-social-engineering-penetration-test