The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill provides a specific automation script to harvest sensitive authentication material. In Phase 5 of SKILL.md, it includes a bash script using osascript to extract active session JWTs from Google Chrome's localStorage (specifically looking for the <app>-token key).
[PRIVILEGE_ESCALATION]: The skill utilizes AppleScript (osascript) to interact with and control external applications. This allows the agent to bypass standard browser isolation and programmatically execute JavaScript within the context of a user's browser tabs to retrieve private session data.
[DYNAMIC_EXECUTION]: Phase 4 of SKILL.md contains instructions to compile a C program at runtime using gcc -O2 -o /tmp/jwtcrack /tmp/jwtcrack.c -lcrypto. This involves executing locally compiled code and requires a dependency (jwtcrack.c) that is not provided within the skill's file set, representing an unverifiable execution risk.
[DATA_EXFILTRATION]: The skill describes methodologies for identifying and extracting sensitive data, including secrets mining from JS bundles (Phase 1), JWT payload analysis (Phase 2), and email spoofing PoCs using smtplib (detailed in references/email-auth.md). These capabilities facilitate the collection and potential external transmission of sensitive organizational data.
[COMMAND_EXECUTION]: The skill makes extensive use of powerful shell commands and system tools, including gcc for compilation, osascript for browser automation, and curl for active network probing and asset retrieval.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a significant attack surface for indirect injection by design.
Ingestion points: Phase 1 (SKILL.md) instructs the agent to fetch and process untrusted HTML, large JavaScript bundles, and OpenAPI specifications from external web targets.
Boundary markers: There are no instructions for using delimiters or protective markers when processing the content of these external assets.
Capability inventory: The skill has access to osascript, gcc, curl, and smtplib (via Python), which could be misused if instructions are embedded within the analyzed web content.
Sanitization: The skill lacks any sanitization or validation steps for the external data it mines, such as the grepped strings from bundles or API documentation.

web-pentest