The Agent Skills Directory

[SAFE]: The skill provides legitimate security testing workflows and scripts for authorized penetration testing environments. It focuses on identifying misconfigured caching layers and unkeyed headers.
[COMMAND_EXECUTION]: Instructions in SKILL.md provide numerous examples of using curl to interact with web caches, test for header reflection, and attempt cache poisoning. These commands are intended for manual verification by a security professional.
[EXTERNAL_DOWNLOADS]: The scripts/agent.py script requires the requests library, which is a well-known and trusted Python package for handling HTTP requests.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a vulnerability surface for indirect prompt injection as it ingests a user-provided target URL and performs automated requests against it, processing the returned response headers and body content.
Ingestion points: The target_url parameter in scripts/agent.py and the target URLs used in curl examples in SKILL.md.
Boundary markers: Absent; the tool is designed to process arbitrary URL inputs for testing purposes.
Capability inventory: Network communication via the requests library in Python and the curl command-line utility.
Sanitization: Absent; as a vulnerability testing tool, it purposefully sends un-sanitized payloads to check for reflection and caching issues.

performing-web-cache-poisoning-attack