The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The installation instructions in SKILL.md direct users to execute a remote script with root privileges using the pattern curl -sSL [URL] | sudo bash. This allows for arbitrary code execution from a third-party source without prior review of the script content.
[COMMAND_EXECUTION]: The skill encourages privilege escalation by instructing users to run both the installation script and the main application (hackingtool.py) with sudo. Additionally, the skill acts as a launcher for 185+ external binaries, significantly increasing the system's attack surface through the execution of unverified third-party tools.
[EXTERNAL_DOWNLOADS]: The skill automates the downloading and installation of a vast array of security tools from numerous external GitHub repositories and package registries, which may lead to the introduction of unverified or malicious code into the environment.
[PROMPT_INJECTION]: The skill includes a 'recommendation engine' that processes natural language input to suggest tools, creating a surface for indirect prompt injection.
Ingestion points: User-provided goal descriptions in the recommendation feature (SKILL.md).
Boundary markers: Absent; the skill does not use delimiters or instructions to ignore embedded commands in user input.
Capability inventory: The skill can install and execute over 185 distinct system tools and scripts (SKILL.md).
Sanitization: Absent; there is no mention of input validation or escaping for the goals processed by the engine.

hackingtool