The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts/recon-scan.sh script executes system commands including nmap, curl, and python3 to perform network reconnaissance. The script includes a fallback mechanism that uses insecure TLS validation (-k) if a strict connection fails, which is documented as an infrastructure finding to be recorded.
[DYNAMIC_EXECUTION]: The skill uses Python heredocs within the scripts/recon-scan.sh shell script to dynamically execute logic for URL parsing, CIDR-based scope validation, and JSON-formatted logging at runtime.
[INDIRECT_PROMPT_INJECTION]:
Ingestion points: The skill is designed to fetch and process untrusted data from remote targets, including HTTP headers, robots.txt, sitemap.xml, and web page content during the recon and exploitation phases.
Boundary markers: The skill implements a strict authorization gate, requiring the agent to wait for a specific "authorized" response from the user and verify an authorization record in pentest-engagement/authorization.md before performing active scans.
Capability inventory: The skill has the capability to make network requests (curl, nmap), generate potentially dangerous payloads (SQLi, XSS, RCE witnesses), and write findings to the local filesystem.
Sanitization: As a vulnerability analysis tool, the skill intentionally processes and analyzes raw, unsanitized responses to identify security flaws in the target application.

web-pentest