The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the user to clone multiple third-party GitHub repositories that are not from recognized trusted organizations.
https://github.com/IoTsec/loraserver-attack-tools is used for LoRaWAN packet injection.
https://github.com/AndrewMohawk/RollingPwn is used for rolling code research.
https://github.com/Lora-net/LoRaMac-node is used for LoRaWAN stack analysis.
[REMOTE_CODE_EXECUTION]: The skill recommends executing Python scripts downloaded from untrusted sources immediately after cloning.
Evidence: python lora_inject.py --nwkskey <NWKS> --appskey <APPS> --devaddr <ADDR> using files from the IoTsec repository.
[COMMAND_EXECUTION]: The skill utilizes several local command-line tools for RF capture, transmission, and analysis, which could be misused if provided with malicious arguments.
Evidence: Commands for hackrf_transfer, rtl_433, and urh (Universal Radio Hacker).
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted RF data from external environments, creating a potential surface for indirect injection if tool outputs are piped back into the agent context.
Ingestion points: rtl_433 -f 315M -F json and hackrf_transfer captures processed by URH.
Boundary markers: None present; the instructions do not include delimiters or warnings to ignore embedded content in processed data.
Capability inventory: The skill has the capability to write to the file system via hackrf_transfer and git clone, and transmit RF data via lora_inject.py.
Sanitization: None; the skill lacks any validation or escaping for the data received from SDR tools.

offensive-lorawan-sub-ghz