The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/agent.py contains a function check_adb_deep_link that uses subprocess.check_output to execute adb commands. This is a standard mechanism for interacting with Android devices during mobile security testing and does not utilize a shell for execution, mitigating command injection risks.
[INDIRECT_PROMPT_INJECTION]: The skill includes scripts that parse external application configuration files (AndroidManifest.xml and Info.plist) to identify potential attack vectors.
Ingestion points: Files are parsed in scripts/agent.py and scripts/process.py using regular expressions and XML tree parsing.
Boundary markers: None explicitly implemented.
Capability inventory: The skill includes functions for executing local commands (adb) and generating test payloads, though these are directed at the mobile application being tested.
Sanitization: Standard parsing libraries are used for data extraction, and the resulting data is primarily used for reporting and generating command-line instructions.
[EXTERNAL_DOWNLOADS]: The skill workflow includes curl commands in documentation to retrieve apple-app-site-association files from target web domains. This is a standard procedure for evaluating iOS Universal Link configurations.

exploiting-deeplink-vulnerabilities