The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs users to install a plugin from an unverified GitHub repository (Stickman230/claude-pentest) and to clone a remote server framework from another unknown source (Wh0am123/MCP-Kali-Server).
[REMOTE_CODE_EXECUTION]: Installation and setup instructions for the framework and its Kali server component involve downloading and executing code from unknown external sources, potentially allowing arbitrary code execution within the environment.
[DYNAMIC_EXECUTION]: The framework is designed to automatically generate and execute Python scripts (e.g., poc.py) to verify vulnerabilities. While human-in-the-loop approval is mentioned, the underlying mechanism involves executing AI-generated code snippets.
[INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection as it ingests and processes untrusted content from user-defined target websites.
Ingestion points: Target URLs provided in engagement configurations.
Boundary markers: Mentions human-in-the-loop approval gates for exploitation attempts.
Capability inventory: Includes file system write access to the outputs/ directory, network request capabilities, and the execution of generated Python scripts.
Sanitization: No specific sanitization or validation of content retrieved from target websites is described.
[COMMAND_EXECUTION]: The skill utilizes various command-line tools such as curl, nmap, and sqlmap, and coordinates these through both local shell execution and remote HTTP requests to a configured Kali server.
[CREDENTIALS_UNSAFE]: Example configuration files (.pentest-scope.json) provided in the documentation contain hardcoded plaintext credentials (username: jsmith, password: demo1234). Although these are for a known demo site, they promote the unsafe practice of storing credentials in project-level JSON files.

claude-pentest-framework