The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The skill instructions in reference/scenarios/vhost-enumeration.md recommend modifying the system /etc/hosts file using sudo tee -a /etc/hosts. This encourages the agent to perform administrative actions that bypass normal file system permissions.
[DYNAMIC_EXECUTION]: The deobfuscation procedure detailed in reference/scenarios/obfuscated-js-deobfuscation.md directs the agent to create and run a Node.js script that uses eval() and require('fs').readFileSync() to execute the contents of JavaScript files downloaded from potentially malicious external targets. This incorporates untrusted code directly into the execution environment.
[REMOTE_CODE_EXECUTION]: By downloading scripts from arbitrary network locations and evaluating them locally to extract endpoints or logic, the skill establishes a vector for remote code execution. A malicious target could serve a crafted payload that, when processed by the agent's deobfuscation routine, executes harmful code on the agent's host system.
[INDIRECT_PROMPT_INJECTION]: The skill operates by ingesting vast amounts of untrusted data from network targets, including HTTP headers, API responses, and JavaScript bundles.
Ingestion points: Raw outputs from curl, subfinder, nmap, and ffuf stored in recon/raw/.
Boundary markers: None; the skill processes untrusted files without delimiters or instructions to ignore embedded commands.
Capability inventory: The skill utilizes high-privilege capabilities including network operations, file system modification, and dynamic code execution.
Sanitization: There is no evidence of sanitization or safety checks applied to the content before it is processed by shell loops, Node.js scripts, or regex miners.
[COMMAND_EXECUTION]: The skill relies heavily on shell commands and external binaries (e.g., nmap, masscan, ffuf) to perform its tasks. The construction of these commands often involves parameters derived from target-provided data, such as hostnames and URLs, which increases the risk of command injection if the input is not strictly validated.

reconnaissance