The Agent Skills Directory

[DATA_EXFILTRATION]: The skill includes payloads designed to access sensitive local file paths (e.g., /etc/passwd, C:/windows/win.ini) and cloud metadata endpoints (e.g., 169.254.169.254/latest/meta-data/). These are used as static strings in SKILL.md and scripts/agent.py for testing remote targets for data disclosure vulnerabilities.
[COMMAND_EXECUTION]: The scripts/agent.py utility utilizes the requests library to perform network POST operations against target URLs provided by the user, transmitting XML and JSON payloads.
[OBFUSCATION]: The XXE_PAYLOADS dictionary in scripts/agent.py contains a utf7_encoding entry which holds an encoded XML payload. This is intended to demonstrate WAF evasion techniques but constitutes encoded executable content within the skill's scripts.
[INDIRECT_PROMPT_INJECTION]: The skill ingests arbitrary data from target server responses and incorporates it directly into a local JSON report file without sanitization. This establishes a vulnerability surface where the agent could be influenced by malicious content reflected from a target system.
Ingestion points: Network response bodies (resp.text) captured by the XMLInjectionTestAgent in scripts/agent.py.
Boundary markers: None. The report is generated using standard JSON serialization without delimiters or instructions to ignore embedded content.
Capability inventory: Network POST requests via requests, directory and file creation via pathlib.Path.mkdir and json.dump.
Sanitization: No filtering or validation is performed on the data retrieved from external servers before it is stored in the findings report.

testing-for-xml-injection-vulnerabilities