The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill documentation encourages users to install the tool using a pattern that pipes a remote script directly into a shell interpreter (e.g., curl -fsSL ... | bash). This occurs with the URL https://raw.githubusercontent.com/s0ld13rr/pentestcode/main/install.sh. The source account 's0ld13rr' is not a trusted vendor, and executing its content without inspection allows for complete system compromise.
[EXTERNAL_DOWNLOADS]: The skill downloads and executes an installation script from an external, untrusted GitHub repository (s0ld13rr/pentestcode).
[PROMPT_INJECTION]: The skill identifies a '/mode free' operational state which is described as bypassing all scope checks and responding to direct requests without phase structure. This instruction explicitly tells the AI agent to ignore safety boundaries and operational constraints.
[INDIRECT_PROMPT_INJECTION]: The skill relies on parsing outputs from external security tools (Nmap, Nuclei, NetExec, GoBuster, etc.) to update its internal engagement state. This creates an attack surface where malicious data returned by a target system (e.g., a crafted service banner or hostname) could influence the agent's behavior when parsed.
Ingestion points: Tools such as nmap_parse, nuclei_parse, cme_parse, gobuster_parse, bloodhound_parse, and sqlmap_parse ingest external content from files into the agent's state (SKILL.md).
Boundary markers: None. The skill does not define delimiters to separate untrusted tool output from internal instructions.
Capability inventory: The skill possesses high-privilege capabilities including arbitrary command execution for security scanning, network communication, and file system modifications for state management.
Sanitization: The skill body lacks any reference to sanitization or validation of the ingested data.
[METADATA_POISONING]: There is significant inconsistency in the skill's metadata. While the system identifies the author as 'reason-machines', the skill text claims it is from 'ara.so', and the software is hosted under the GitHub user 's0ld13rr'. These conflicting identifiers are deceptive and make it difficult to verify the origin of the code.
[COMMAND_EXECUTION]: The skill is designed to coordinate and execute a wide range of powerful command-line security tools (e.g., nmap, nuclei, gobuster, netexec, bloodhound, crackmapexec) based on AI-interpreted goals, which could be leveraged for unauthorized activities if the agent is compromised.

pentestcode-ai-pentest-agent