The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructions direct the user to clone a repository from an untrusted GitHub account (https://github.com/Poellie01/PentestCompanion.git) and install its dependencies via pip install -r requirements.txt. This represents a supply chain risk as the source and its dependencies are not from a trusted vendor or well-known organization.
[COMMAND_EXECUTION]: The installation and operation workflows involve several high-risk shell commands, including piping output to sed for environment variable modification and using curl to transmit data from the local terminal to a web server.
[PERSISTENCE]: The documentation explicitly suggests adding a helper function (pclog) to shell profile files such as ~/.bashrc or ~/.zshrc. This modification ensures the logging utility—which handles data transmission—persists across all future terminal sessions.
[DYNAMIC_EXECUTION]: The skill utilizes python3 -c to execute inline Python code for secret generation and JSON parsing within shell commands. Additionally, it describes a mechanism for adding 'Custom Tools' that dynamically build and execute shell commands via subprocess.run based on target input.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a significant attack surface for indirect prompt injection by ingesting external, untrusted data formats such as Nessus XML and Burp Suite findings.
Ingestion points: Findings are imported via file uploads (.nessus or Burp XML) in the UI.
Boundary markers: There are no documented boundary markers or instructions to the agent to ignore embedded malicious instructions in the imported data.
Capability inventory: The skill has extensive capabilities including subprocess execution (tools/custom_tool.py), file system writes (utils/report.py), and network requests via its API.
Sanitization: No evidence of sanitization or validation of the imported report data is provided in the skill description.
[REMOTE_CODE_EXECUTION]: The core functionality involves orchestrating and executing various security tools (nmap, sqlmap, etc.) on the host system or within containers, often triggered by the AI agent through the application's API.

pentestcompanion-workspace