The Agent Skills Directory

[SAFE]: The skill serves as an educational resource for security professionals and developers. While it contains numerous examples of malicious payloads (e.g., ../../../etc/passwd, null byte injections, and log poisoning techniques), these are presented in the context of security testing methodologies and defensive coding practices.
[REMOTE_CODE_EXECUTION]: The skill documents how Local File Inclusion (LFI) can be escalated to Remote Code Execution (RCE) via log poisoning and PHP wrappers. However, these are documented as theoretical attack vectors for testing purposes rather than active exploits targeting the user's environment.
[COMMAND_EXECUTION]: The skill provides various curl and ffuf command-line examples. These commands are illustrative and intended for use against a user-defined target in a penetration testing context. There are no automated or silent execution patterns detected within the skill itself.
[DATA_EXFILTRATION]: The skill lists sensitive files like /etc/shadow, id_rsa, and wp-config.php as high-value targets. This is standard for security audit documentation to help testers understand the impact of a vulnerability.
[FRONTMATTER_RULE]: The skill does not define allowed-tools, which means it operates within the default capabilities of the agent environment. The metadata and descriptions accurately reflect the content of the skill.

File Path Traversal Testing