The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The skill instructs the agent to use sudo apt-get install to install security tools such as nmap, netcat, hydra, and smtp-user-enum on the host system.\n- [EXTERNAL_DOWNLOADS]: The skill requires the installation of external software packages from the system's package repository to perform its core functions.\n- [COMMAND_EXECUTION]: The skill relies on a wide array of shell commands to perform network scanning, service interaction, and automated exploitation. Evidence includes: \n
Use of nmap with NSE scripts for service discovery and vulnerability scanning.\n
Use of nc (Netcat) and telnet for manual SMTP banner grabbing and command interaction.\n
Use of hydra and medusa for performing dictionary-based brute force attacks against SMTP authentication.\n
Use of smtp-user-enum for automating user enumeration via VRFY, EXPN, and RCPT commands.\n
Use of msfconsole (Metasploit) for specialized SMTP scanning modules.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes data from external, potentially untrusted network sources, creating a surface for indirect prompt injection. \n
Ingestion points: SMTP server banners, command response codes (e.g., 220, 250, 550), and DNS records (MX, SPF, DMARC, DKIM) returned from target domains.\n
Boundary markers: No specific delimiters or "ignore previous instruction" warnings are provided when processing the output from external tools.\n
Capability inventory: The skill has significant capabilities including network communication, shell command execution, and interaction with various security frameworks.\n
Sanitization: There is no explicit sanitization or escaping of external content (such as captured banners or DNS records) before it is processed or presented to the agent.

smtp-penetration-testing