The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill fetches IP geolocation and ASN information from ipinfo.io and updates vulnerability templates for the nuclei scanner. These are well-known services used for reconnaissance and security testing.
[COMMAND_EXECUTION]: The skill performs extensive system commands including network scanning (nmap), web application testing (nikto, nuclei), and system auditing. It specifically reads sensitive system files such as /etc/passwd and searches the filesystem for SSH private keys (id_rsa, .pem) and authorized_keys to identify potential credential exposure.
[PRIVILEGE_ESCALATION]: The skill includes checks for privilege escalation vectors, such as searching for non-standard SUID/SGID binaries, reviewing sudo -l permissions, and identifying world-writable scripts executed by cron jobs. It also suggests running the lynis security auditor with sudo privileges.
[INDIRECT_PROMPT_INJECTION]: The skill ingests and processes output from several external sources, including nmap service banners, web server headers via nikto, and vulnerability results from nuclei. This data is untrusted and could potentially contain malicious instructions intended to manipulate the agent's behavior during report generation or subsequent analysis tasks.
[DYNAMIC_EXECUTION]: The skill includes a pre-written Bash script designed to be executed at the end of the scan to aggregate results from multiple local files and generate a markdown report. The script performs string manipulation and parsing of command output.
[DATA_EXFILTRATION]: By performing reconnaissance via ipinfo.io, the target IP address is shared with a third-party service. While the skill does not exfiltrate server data to an attacker-controlled endpoint, the internal scan phase collects highly sensitive information about the server's users, keys, and security posture.

server-security-scan