The Agent Skills Directory

[COMMAND_EXECUTION]: The automation scripts scripts/agent.py and scripts/process.py execute the nikto command-line tool using the subprocess.run function. The implementation uses a list of arguments rather than a single string with shell=True, which is a recommended security practice to prevent shell injection vulnerabilities when handling target inputs.\n- [DYNAMIC_EXECUTION]: The script scripts/agent.py utilizes the standard xml.etree.ElementTree library for parsing Nikto XML results. This parser is vulnerable to XML External Entity (XXE) attacks. While the risk is lowered because the XML is generated by a local tool, using a hardened parser like defusedxml (as seen in scripts/process.py) is the preferred standard.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes data from external web servers which may contain malicious strings. In scripts/process.py, scan results like URIs and server descriptions are inserted directly into an HTML report using f-strings without escaping. This creates a potential Cross-Site Scripting (XSS) surface for users viewing the report.\n
Ingestion points: Nikto XML scan results containing data fetched from external web servers.\n
Boundary markers: No sanitization or escaping is applied to findings before inclusion in the HTML report.\n
Capability inventory: System command execution (Nikto) and local file writing for reporting.\n
Sanitization: The scripts/process.py script uses defusedxml for input parsing, but the output report generation lacks HTML entity encoding.

performing-web-application-scanning-with-nikto