The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides templates for using external security tools such as Hydra and Burp Suite to perform brute-force and credential stuffing attacks against target applications.
[DYNAMIC_EXECUTION]: Phase 6 includes an inline Python script using the requests library to programmatically collect and analyze session tokens from a target web server.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and act upon data retrieved from external web servers (HTTP headers, cookies, and response bodies), creating a vulnerability surface for instructions embedded in attacker-controlled responses.
Ingestion points: HTTP response headers, cookies, and API response bodies processed in Phase 1, Phase 3, Phase 6, and Phase 10.
Boundary markers: The skill includes a 'Mandatory confirmation gate' requiring the agent to obtain explicit user confirmation of the target and authorization before executing probes or exploits.
Capability inventory: Shell command execution (hydra), network operations (python requests), and file writing for reporting purposes.
Sanitization: The provided session analysis script does not implement sanitization or validation of the session tokens received from the target server before processing them.

broken-authentication