The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts/agent.py script manages the fuzzing lifecycle by executing external tools including afl-clang-fast, afl-fuzz, and afl-cmin. It correctly uses the subprocess module with argument lists instead of shell strings to mitigate command injection risks.
[EXTERNAL_DOWNLOADS]: The skill references and instructs the installation of the AFL++ toolchain from official package repositories and GitHub sources, which are well-known security testing utilities.
[PRIVILEGE_ESCALATION]: The SKILL.md instructions include the use of sudo apt-get for dependency installation, which is a standard requirement for configuring CI/CD runner environments.
[INDIRECT_PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface through its automated crash triage functionality.
Ingestion points: The triage_crashes function in scripts/agent.py reads raw bytes from crash files generated during fuzzing.
Boundary markers: None are present between the untrusted crash data and the binary execution.
Capability inventory: The script has the capability to compile code and execute arbitrary binaries with the provided crash data as input.
Sanitization: The script mitigates shell-level injection by passing inputs through subprocess.run as byte streams and avoiding shell interpolation.

implementing-fuzz-testing-in-cicd-with-aflplusplus