The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the user to clone a repository from an untrusted source: https://github.com/KeygraphHQ/shannon.git.
[REMOTE_CODE_EXECUTION]: The instructions direct the user to execute a shell script (./shannon) downloaded from the external repository, which could lead to the execution of arbitrary malicious code in the user's environment.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to read and analyze arbitrary source code provided by the user (REPO=/path/to/repo), which acts as an untrusted data ingestion surface.
Ingestion points: Reads the contents of the repository specified in the REPO parameter in SKILL.md.
Boundary markers: No delimiters or instructions are present to prevent the agent from following malicious prompts embedded within the analyzed source code.
Capability inventory: The skill has significant capabilities, including running Docker containers, performing network scans with Nmap and Subfinder, and executing web exploits (SQLi, XSS, SSRF).
Sanitization: No evidence of sanitization or filtering of the source code content before processing is provided.
[PRIVILEGE_ESCALATION]: The troubleshooting section suggests escalating the current user's privileges to the docker group using sudo usermod -aG docker $USER, which grants elevated permissions over the host system.

shannon-ai-pentester