The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes various security tools including nmap for network scanning and nuclei for vulnerability detection. It also supports a custom_report_cmd parameter that allows for the execution of a user-specified command to handle report generation, which receives paths to sensitive report data.
[DATA_EXFILTRATION]: The workflow includes a mechanism to transmit the generated penetration test deliverable (a ZIP file containing findings and artifacts) to an external Slack channel using the tools/slack-send.py utility script.
[CREDENTIALS_UNSAFE]: The skill is designed to interact with sensitive credentials stored in a .env file. It utilizes a utility script, tools/env-reader.py, to fetch secret values based on environment variable names provided in the scope configuration.
[EXTERNAL_DOWNLOADS]: The skill performs active and passive reconnaissance by reaching out to external services such as crt.sh, certspotter, and subfinder for subdomain discovery and certificate logging data, and uses tools/nvd-lookup.py to query vulnerability databases.
[PROMPT_INJECTION]: The skill ingests external scope files (Markdown or JSON) which define the engagement parameters, representing a surface for indirect prompt injection.
Ingestion points: scope_file parameter and scope configuration object.
Boundary markers: None identified; the workflow treats the scope file as an authoritative source of testing targets and rules.
Capability inventory: Subprocess execution for scanning tools, file system writes for results, and network operations for reporting.
Sanitization: No explicit sanitization or validation of the scope file content is documented.

pentest-engagement