The Agent Skills Directory

[PROMPT_INJECTION]: The skill explicitly directs the agent to override platform interaction gates, specifically identifying user-confirmation checks (AskUserQuestion) as 'stalls' and 'anti-patterns' to be ignored. This bypasses the intended safety and oversight mechanisms of the agent's environment by assuming permanent authorization once an engagement mode is selected.\n- [REMOTE_CODE_EXECUTION]: The skill encourages the installation of third-party software and libraries, such as 'brew install jadx' and various OCR models, introducing external dependencies that are not verified for integrity or safety during runtime.\n- [COMMAND_EXECUTION]: The instructions mandate an aggressive testing cadence, including high-volume automated requests (e.g., 3,000+ well-tagged requests) and the use of offensive techniques such as IP rotation and User-Agent spoofing to evade detection, which may lead to service disruption or account lockouts.\n- [DATA_EXFILTRATION]: The skill promotes network communication with non-whitelisted external domains and the extraction of sensitive secrets (e.g., AWS, GCP, and Stripe keys) and personal data from target assets (e.g., /.git, /.env, /heapdump).\n- [INDIRECT_PROMPT_INJECTION]: The skill provides procedures for the agent to ingest and analyze untrusted data from targets (e.g., JS bundles, robots.txt, API specifications, and APK files) without adequate sanitization or boundary markers, creating a vulnerability to instructions embedded in external content.\n
Ingestion points: Harvesting JS bundles, reading robots.txt and sitemap.xml, API endpoint discovery, and APK decompilation (SKILL.md).\n
Boundary markers: None specified in the instructions to protect against instructions embedded in target data.\n
Capability inventory: Extensive network probing, shell command execution (e.g., brew, jadx), and local state logging (SKILL.md).\n
Sanitization: No instructions provided for escaping or validating external content before processing.

redteam-mindset