The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill is configured to fetch and execute its core MCP server logic dynamically from the npm registry using npx -y rea-agents@6.7.0 (SKILL.md, references/connection-and-recovery.md). This introduces a runtime dependency on external code that is not bundled with the skill.
[COMMAND_EXECUTION]: Multiple tools provide the agent with the ability to execute arbitrary commands and code on the host system: execute_rizin_command and cutter_command are documented as being able to "execute code, write files or reach the network" (SKILL.md). load_frida_script allows injecting and executing arbitrary JavaScript into running processes (SKILL.md). capture_process_scenario runs shell commands under a PTY (SKILL.md). gdb_console and rizin_debug_command provide access to debuggers capable of controlling and executing target applications.
[DATA_EXFILTRATION]: The skill possesses extensive capabilities to read sensitive local data: inspect_sqlite_database allows reading content from local database files (SKILL.md, references/native-and-artifacts.md). list_browser_targets and inspect_web_page can access data from open browser sessions (SKILL.md, references/runtime-observation.md). inspect_recorded_crash reads Linux ELF core dumps which may contain sensitive memory contents (SKILL.md, references/native-and-artifacts.md). inspect_web_network_capture and inspect_packet_capture read network traffic captures containing potentially sensitive communication.
[DYNAMIC_EXECUTION]: The skill utilizes dynamic instrumentation and debugging tools (Frida, GDB, Rizin) to interact with and inject logic into processes at runtime. Frida is used to load and unload scripts into process memory, and debuggers can modify execution flow and state.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted, complex data types including decompiled code, binary metadata, and network captures. This creates a surface for indirect prompt injection where malicious instructions could be embedded in the analyzed artifacts.
Ingestion points: Artifacts loaded via open_binary, inspect_android_package, inspect_web_page, and various capture tools.
Boundary markers: The skill suggests using Evidence IDs but lacks robust delimiters to prevent the agent from following instructions found within analyzed data.
Capability inventory: Full access to sub-processes, debuggers, and file-system read/write tools.
Sanitization: No explicit sanitization of technical data before it is presented to the agent's context is described.
[EXTERNAL_DOWNLOADS]: The skill fetches the rea-agents package from the public npm registry at runtime.

reverse-engineer-anything