The Agent Skills Directory

[COMMAND_EXECUTION]: The skill documentation and accompanying Python scripts (port_scanner.py, subdomain_enum.py, full_recon.py) make extensive use of subprocess.run to execute external command-line tools such as nmap, subfinder, dnsx, httpx, nuclei, and ffuf.- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted external data, specifically target domains and URLs provided by the user or fetched during reconnaissance.
Ingestion points: Target domains, URLs, and web responses (e.g., in sqli_tester.py and xss_tester.py) enter the agent context.
Boundary markers: None are specified in the instructions or scripts to separate instructions from the data being tested.
Capability inventory: The skill possesses high capabilities, including network requests (requests library), file system writes (saving results to JSON/TXT), and shell command execution via numerous third-party tools.
Sanitization: The provided Python scripts do not implement input validation or sanitization on target strings before they are interpolated into command arguments or HTTP requests.- [EXTERNAL_DOWNLOADS]: The installation guide instructs the user to download several third-party security tools from official package managers (apt, brew, pip) and public GitHub repositories (e.g., github.com/projectdiscovery/*). This is standard procedure for setting up a security testing environment.

pentest-skills-framework