The Agent Skills Directory

[COMMAND_EXECUTION]: The workflow documentation in SKILL.md includes examples using curl, zap-cli, and python3 to interact with target web servers and security scanning tools. These commands are consistent with the skill's primary function as a penetration testing utility.
[EXTERNAL_DOWNLOADS]: The skill utilizes the requests library for Python, as specified in scripts/agent.py and references/api-reference.md. This is a well-known, standard library for HTTP communication.
[INDIRECT_PROMPT_INJECTION]: The scripts/agent.py script presents an attack surface by reading and returning content from remote target servers that the agent subsequently processes. While this could theoretically be used to influence agent behavior if a target server is controlled by an attacker, this mechanism is essential for performing the vulnerability assessments described.
Ingestion points: scripts/agent.py reads and processes the response body from remote URLs provided during command execution.
Boundary markers: The script returns data in structured JSON format, which provides a clear separation between the tool's logic and the processed data.
Capability inventory: The skill can perform GET and POST requests to user-defined URLs and analyze response attributes like status codes and content lengths.
Sanitization: The script performs basic truncation of response data in some tests, though it does not explicitly sanitize the content for potential prompt injection strings.

performing-http-parameter-pollution-attack