The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to "build and start the app the way the project expects," providing examples like spring-boot:run, java -jar, and docker compose. This allows for the execution of arbitrary shell commands within the environment.
[REMOTE_CODE_EXECUTION]: A core component of the workflow is to "Write and run the PoC script" using Python. Generating and executing code at runtime, especially when the logic is derived from external "finding" data, is a high-risk dynamic execution pattern.
[DATA_EXFILTRATION]: The skill provides explicit examples and instructions for the agent to attempt accessing sensitive system files (e.g., /etc/passwd) and internal network endpoints (e.g., the cloud metadata service at 169.254.169.254) as part of its vulnerability testing routine.
[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface.
Ingestion points: The agent reads untrusted data from finding files located in .opentaint/tracking/findings/.
Boundary markers: None are specified to separate instruction from data within these files.
Capability inventory: The agent possesses the capability to execute shell commands and run dynamically generated Python code.
Sanitization: No sanitization or validation of the input findings is described, potentially allowing an attacker to influence the PoC generation or application startup commands through a malicious finding file.

generate-poc