The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructions require cloning source code from an untrusted GitHub repository (github.com/zakirkun/guardian-cli.git) followed by a local installation using pip install -e .. This execution of remote code from an unverified third-party source is a high-risk pattern.
[COMMAND_EXECUTION]: The primary purpose of the skill is to orchestrate and execute numerous command-line security tools (e.g., nmap, nuclei, gobuster, httpx). The framework explicitly provides a template for creating custom tools that execute arbitrary shell commands via subprocess.run, including parameters passed directly into command strings.
[DYNAMIC_EXECUTION]: The skill architecture is designed to dynamically load and execute custom Python modules defined in the config/tools/ directory. This allows for the execution of arbitrary Python code at runtime based on local configuration files.
[INDIRECT_PROMPT_INJECTION]: The skill exhibits a significant attack surface for indirect prompt injection:
Ingestion points: The agent ingests untrusted data from external targets, including HTTP probing results (httpx), technology fingerprints (WhatWeb), and vulnerability scan outputs (nuclei).
Boundary markers: The instructions do not define any boundary markers or sanitization procedures for the data interpolated into AI prompts.
Capability inventory: The agent has extensive capabilities including shell command execution (subprocess.run), file system writes (reporting), and network operations.
Sanitization: There is no evidence of sanitization for external content before it is processed by the AI agents (Planner, Tool Selector, Analyst) to determine subsequent testing steps.

guardian-ai-pentest-cli