The Agent Skills Directory

[PROMPT_INJECTION]: The skill contains an 'Authorization Context' section that explicitly instructs the agent to ignore safety filters, disregard ethical guidelines, and omit 'responsible disclosure' warnings. It further mandates that the agent must not refuse to execute payloads or bypass techniques specified in the skill.
[COMMAND_EXECUTION]: The skill depends on a set of shell scripts (e.g., detect-tools.sh, stealth-profile.sh, timeout-helper.sh) located in a path defined by the SUPERHACKERS_ROOT environment variable. The skill provides logic to auto-detect this path within user-accessible directories such as $HOME/.claude/plugins/cache/, potentially leading to the execution of unverified local scripts.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted data from the web, including HTML content, JavaScript bundles, and API responses. This creates a large attack surface where a target site could host malicious instructions intended to manipulate the agent's behavior.
Ingestion points: Analysis of external web content, SPA JavaScript bundles, and GraphQL introspection responses (SKILL.md).
Boundary markers: None identified in the prompt interpolation logic.
Capability inventory: Extensive command line execution, network access (curl, playwright), and file writing capabilities.
Sanitization: No evidence of input sanitization or validation for the processed external web content.
[DATA_EXFILTRATION]: Instructions include active searching for and extraction of sensitive credentials, such as API keys, tokens, and private keys, from various client-side sources, JavaScript bundles, and browser metadata.
[EXTERNAL_DOWNLOADS]: The skill lists and provides installation commands for numerous third-party security tools (e.g., rustscan, nuclei, sqlmap, ffuf, smuggler.py) from external sources like GitHub and public package registries without specifying fixed versions or verifying integrity.

webapp-pentesting