The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The installation process clones a repository from an external GitHub account (https://github.com/H-mmer/pentest-agents-suite). The framework's rag-builder component also clones additional external repositories listed in its configuration files.\n- [REMOTE_CODE_EXECUTION]: Multiple Python scripts from the downloaded repository are executed locally during framework setup and operation, including tools/installer.py, tools/scaffold.py, and MCP server implementations.\n- [PERSISTENCE]: The skill instructs the user to modify the agent's settings.json to include event-based hooks (hooks/cost_hook.py and hooks/welcome.py). These hooks execute local scripts from the downloaded repository automatically whenever a subagent stops or a session starts.\n- [DYNAMIC_EXECUTION]: Employs the uv tool to dynamically install Python packages like faiss-cpu and sentence-transformers at runtime. The installer also provides commands to dynamically regenerate provider bundles.\n- [COMMAND_EXECUTION]: The scaffold.py tool uses the subprocess module to execute shell commands for directory and workspace management.\n- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted data from external sources.\n
Ingestion points: Third-party vulnerability writeups (metadata.db), remote repository lists (repos.yaml), and bug bounty platform data (scopes, policies, and public hacktivity).\n
Boundary markers: A 7-Question Gate validation process is used to evaluate findings before submission.\n
Capability inventory: The framework possesses capabilities for network API access, file system modification, and shell command execution via internal tools.\n
Sanitization: No specific content sanitization or instruction filtering for ingested writeup data is documented.

pentest-agents-bug-bounty-framework