The Agent Skills Directory

[COMMAND_EXECUTION]: The skill directly interpolates the user-supplied $ARGUMENTS variable into multiple shell commands across all diagnostic steps. This allows an attacker to execute arbitrary commands by providing a target string containing shell metacharacters (e.g., example.com; whoami).
Evidence includes:
bash scripts/diagnostics/dns.sh $ARGUMENTS (Step 1)
dig $ARGUMENTS A +noall +answer (Step 1)
ping -c 4 $ARGUMENTS (Step 2)
curl -sI --connect-timeout 5 http://$ARGUMENTS (Step 2)
nc -zv $ARGUMENTS 22 2>&1 (Step 2)
mtr --report $ARGUMENTS (Step 4)
[DYNAMIC_CONTEXT_INJECTION]: The skill uses the !command`` syntax to execute a shell command at the time the skill is loaded or displayed.
Evidence: !test -f scripts/diagnostics/dns.sh && echo "YES" || echo "NO"`` in the Environment Detection section.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external network sources (DNS records, HTTP headers, traceroute paths) and explicitly instructs the agent to "Interpret their text output directly." This creates a surface where a malicious target could serve content designed to influence the agent's behavior.
Ingestion points: Output from network tools including dig, curl, ping, nc, traceroute, and mtr (SKILL.md).
Boundary markers: None present; outputs are read directly into the context.
Capability inventory: The skill has access to shell execution (bash), local file reading (cat .pentest/scope.json), and various network tools.
Sanitization: No sanitization or validation of the external command output is performed before the agent processes it.

diagnose