The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the agent to download the software repository from a third-party source: https://github.com/Gowtham-Darkseid/AutoPentestX.git.
[REMOTE_CODE_EXECUTION]: The installation process involves cloning a remote repository and executing its contents using pip install -r requirements.txt and running the script autopentestx.py. As the source is not a verified or trusted vendor, this represents the execution of unverified remote code.
[PRIVILEGE_ESCALATION]: The skill documentation explicitly recommends running the tool with sudo privileges (sudo python3 autopentestx.py) to access restricted scanning features. It also suggests modifying system capabilities using sudo setcap cap_net_raw+ep /usr/bin/python3 and changing file permissions with chmod +x autopentestx.py.
[COMMAND_EXECUTION]: The skill triggers the execution of external security tools such as nmap, masscan, and nikto via shell commands. It also includes integration with Metasploit via pymetasploit3, which involves executing exploit payloads on remote targets.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a high-risk attack surface for indirect prompt injection.
Ingestion points: The agent processes external data from scanned target systems, web application responses (SQLi and XSS testing), and target lists provided in files (targets.txt).
Boundary markers: There are no explicit delimiters or instructions to ignore embedded malicious content within the processed scan results or target data.
Capability inventory: The skill has the ability to perform network requests (requests.post), write files (json.dump to reports), execute shell commands (sudo), and run security exploits (exploit.execute()).
Sanitization: The skill lacks documentation for sanitizing or filtering instructions that might be embedded in the HTML, JS, or service headers of the systems being scanned.
[DYNAMIC_EXECUTION]: The skill facilitates the dynamic execution of security exploits through the Metasploit framework and utilizes parallel processing (concurrent.futures.ThreadPoolExecutor) to run scanning logic that may be influenced by external input.

autopentestx-automated-pentesting