The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection as it is designed to ingest and analyze untrusted data from target applications and source code repositories.
Ingestion points: The skill reads source code from source_repo and processes responses from target_url.
Boundary markers: The skill implements an authorization gate requiring explicit user confirmation and filters production URL patterns, but does not specify internal LLM delimiters for the ingested content.
Capability inventory: The skill can trigger automated security tasks, perform network requests to target systems, and execute multi-agent coordination pipelines.
Sanitization: No specific input sanitization or escaping mechanisms for the external code or responses are documented.
[DATA_EXFILTRATION]: As part of its security validation logic, the skill describes techniques for testing data exposure, including SSRF payloads targeting cloud metadata endpoints (e.g., 169.254.169.254) and protocol smuggling (e.g., file:///etc/passwd). These actions are explicitly restricted to authorized target environments for the purpose of vulnerability confirmation.
[COMMAND_EXECUTION]: The skill incorporates logic for identifying and validating command injection vulnerabilities in target applications. It generates proof-of-concept payloads to test functions like exec() or system(). This behavior is controlled through the 'graduated exploitation' tiers and requires explicit user consent before execution.

qe-pentest-validation