The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to utilize local utility scripts, specifically run-httpx.sh and run-ffuf-safe.sh, to perform route discovery and security scanning tasks within the execution environment.
[EXTERNAL_DOWNLOADS]: To fulfill its primary purpose of API security testing, the skill naturally interacts with external HTTP and API endpoints to probe for vulnerabilities and discover routes.
[PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface because it is designed to ingest and analyze untrusted data returned from external target endpoints.
Ingestion points: Target HTTP/API endpoint responses, including headers and bodies, are read into the agent's context during the assessment phase (documented in SKILL.md and endpoint-checklist.md).
Boundary markers: While the skill advises redacting sensitive request/response pairs in the final report, it does not mandate the use of specific boundary markers or delimiters when the agent originally ingests untrusted response data.
Capability inventory: The skill environment provides access to shell scripts (run-httpx.sh, run-ffuf-safe.sh) capable of performing network discovery and interaction (documented in SKILL.md).
Sanitization: The instructions do not specify any sanitization, filtering, or escaping procedures for the external content retrieved from endpoints before the agent processes and interprets it.

endpoint-pentest