The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill provides installation instructions and Python code examples that contain hardcoded database credentials.
Evidence: The MariaDB setup SQL and the get_db_connection function in the db.py example both use the literal password "123" for the metatron user.
[EXTERNAL_DOWNLOADS]: The installation process involves downloading and executing a shell script from a remote provider to set up the LLM environment.
Evidence: In SKILL.md, the installation steps include curl -fsSL https://ollama.com/install.sh | sh to install the Ollama service.
[COMMAND_EXECUTION]: The skill executes various system reconnaissance tools by interpolating user-supplied target strings into shell commands.
Evidence: In the tools.py code example, functions such as run_nmap, run_whois, and run_nikto pass the target variable directly into the argument list for subprocess.run. While using a list is safer than a raw shell string, a malicious target input could still be used to pass unexpected flags to these tools.
[INDIRECT_PROMPT_INJECTION]: The skill ingests raw data from external tools and passes it to a local LLM for analysis without sufficient sanitization, creating a surface for injection.
Ingestion points: The outputs from system tools (nmap, whois, nikto, etc.) are captured in tools.py and passed to the LLM.
Boundary markers: The prompt in llm.py uses simple plaintext headers (e.g., === NMAP ===) to separate different tool outputs, which is a weak delimiter that can be bypassed by malicious content within those outputs.
Capability inventory: The skill has the capability to execute system commands via subprocess.run, make network requests to a local API via requests, and perform write operations to a MariaDB database.
Sanitization: The provided code snippets do not show any validation or sanitization of the tool outputs or the target input before they are included in the prompt template.

metatron-pentest-assistant