The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructions recommend installing the @darkmoon_ai/mcp-server package from the public npm registry using npx. This involves downloading code from a third-party source not associated with the defined trusted organizations.
[REMOTE_CODE_EXECUTION]: The skill facilitates the execution of remote code by instructing the user to run npx -y @darkmoon_ai/mcp-server. This pattern downloads and executes the latest version of the specified package at runtime, creating a dependency on the package's external maintainers.
[COMMAND_EXECUTION]: Through the run_pentest tool, the skill is capable of launching active offensive security tools and exploitation attempts against network targets. While this is the intended purpose of the skill, it represents a high-risk capability that performs non-read-only actions on the environment.
[INDIRECT_PROMPT_INJECTION]: The skill processes potentially untrusted data from security findings which creates an attack surface for indirect prompt injection.
Ingestion points: Vulnerability data ingested via the get_findings tool output, including finding titles, endpoints, and remediation instructions (SKILL.md).
Boundary markers: The instructions include a specific directive to treat tool output as data rather than instructions, which serves as a prompt-level mitigation against embedded payloads.
Capability inventory: The skill possesses capabilities for starting active security runs (run_pentest) and querying campaign status, which could be influenced by malicious scan results.
Sanitization: The skill relies on natural language instructions for the agent to maintain safety; no programmatic validation or sanitization of the external finding data is implemented.

darkmoon-pentest