The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill has a significant attack surface for indirect prompt injection. The agent is instructed to crawl web applications, fetch headers, and inspect HTML/JavaScript source code. This involves ingesting untrusted data from remote targets which could contain malicious instructions designed to influence the agent's behavior.\n
Ingestion points: browser_navigate tool, curl requests for robots.txt, sitemap.xml, and HTTP headers in scripts/recon-scan.sh, and tech fingerprinting via whatweb.\n
Boundary markers: The skill requires an explicit authorization step (Phase 0) and a scope allowlist (engagement/scope.txt). It also instructs the agent to redact sensitive data (credentials/tokens) in the conversation history to prevent leakage via the auxiliary client.\n
Capability inventory: The agent can execute shell commands (nmap, curl, whatweb via recon-scan.sh), perform browser navigation, and write evidence files to the local engagement/ directory.\n
Sanitization: The recon-scan.sh script performs a host validation check against the scope.txt file before executing network tools.\n- [REMOTE_CODE_EXECUTION]: The skill provides a library of offensive payloads for SQL injection, command injection, and unsafe deserialization (e.g., Python pickle and YAML payloads) in references/exploitation-techniques.md and references/bypass-techniques.md. These are intended to be sent to remote target applications to confirm vulnerabilities.\n- [COMMAND_EXECUTION]: The skill includes a bash script scripts/recon-scan.sh that executes local security tools (nmap, whatweb, curl) using a user-provided target URL. The script includes quoting and a scope enforcement mechanism to prevent unauthorized scanning, but it still executes external processes with external input.\n- [PROMPT_INJECTION]: The skill explicitly instructs the agent to attempt to bypass security filters (WAFs) on target applications. It provides a detailed references/bypass-techniques.md file containing common evasion patterns for various vulnerability classes.\n- [DATA_EXFILTRATION]: The skill instructions acknowledge the risk of capturing sensitive data like credentials and JWT tokens. It mandates redacting these values in the chat history and storing them in local files. However, the use of curl and browser tools to fetch data from remote targets is a fundamental part of its reconnaissance and exploitation phases.\n- [EXTERNAL_DOWNLOADS]: The scripts/recon-scan.sh script performs multiple network requests to the target application to gather reconnaissance data, including HTTP headers and common files like robots.txt.\n- [OBFUSCATION]: The file references/bypass-techniques.md contains a Base64-encoded string (c2xlZXAgNQo=) which decodes to an executable command (sleep 5). This is provided as an example of a command injection bypass payload for testing purposes.

web-pentest