The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The scripts/agent.py script ingests data from the Covenant REST API, including listener details, grunt status, and task outputs, which are then incorporated into reports and console output without sanitization.\n
Ingestion points: API responses in list_listeners, list_grunts, and get_task_output within scripts/agent.py.\n
Boundary markers: None used for interpolating external data into the agent's output.\n
Capability inventory: The agent possesses network access capabilities via the requests library and local file system write permissions for report generation.\n
Sanitization: No escaping or validation is applied to the raw JSON responses before they are processed or displayed.\n- [COMMAND_EXECUTION]: The script provides the capability to assign and execute arbitrary tasks on remote grunts via the Covenant API. This functionality is intended for adversary simulation but enables remote command execution on target systems.\n- [DATA_EXFILTRATION]: Authentication credentials (username and password) are transmitted to a user-specified Covenant server URL. While required for the tool's operation, this involves the transmission of sensitive secrets over the network.\n- [EXTERNAL_DOWNLOADS]: The documentation references external resources including the official Covenant GitHub repository and community security tutorials. These are established sources in the cybersecurity domain.\n- [SAFE]: The script explicitly disables SSL certificate verification in its network requests (verify=False). This practice is frequently used in lab environments with self-signed certificates but exposes communications to potential man-in-the-middle attacks.

performing-red-team-with-covenant