The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts scripts/agent.py and scripts/process.py utilize the subprocess module to automate external security tools including nmap, subfinder, and nuclei. These executions are handled safely via list-based arguments and the default shell=False setting, preventing shell injection vulnerabilities.
[INDIRECT_PROMPT_INJECTION]: The skill demonstrates an attack surface for indirect prompt injection by processing untrusted data from external network services. 1. Ingestion points: The scripts/process.py file reads and parses output from subdomain discovery and vulnerability scanning tools. The scripts/agent.py file captures banners directly from network sockets. 2. Boundary markers: No specific delimiters or instructions to ignore embedded content are used when processing these external strings. 3. Capability inventory: The skill has the ability to execute shell commands and perform network operations via the subprocess and socket modules. 4. Sanitization: There is no evidence of sanitization or validation of the data retrieved from external services before it is processed or included in reports.

performing-external-network-penetration-test