The Agent Skills Directory

[COMMAND_EXECUTION]: The skill contains multiple utility scripts in Bash and Python intended to automate security testing. These include tools for IDOR enumeration, HTTP verb tampering, and race condition testing. While these scripts execute shell commands (e.g., curl) and perform network operations, they are standard penetration testing utilities provided for the user's/agent's legitimate use on external targets.
[REMOTE_CODE_EXECUTION]: A PHP reverse shell payload and various command injection examples are documented in reference/race-conditions-cheat-sheet.md and reference/business-logic-cheat-sheet.md. These are explicitly presented as example payloads for testing file upload and input validation vulnerabilities in target applications, rather than being executed against the agent's environment.
[DATA_EXFILTRATION]: The documentation references sensitive file paths (e.g., /etc/passwd, ~/.aws/credentials) and environment variables (.env). These are listed as targets for information disclosure and IDOR testing within a web application context, which is consistent with the skill's stated purpose of security assessment.
[OBFUSCATION]: The skill includes examples of homoglyph-based attacks (e.g., using a Greek omicron in a domain name) to demonstrate email domain bypass techniques. This is used pedagogically and does not represent an attempt to hide malicious intent within the skill itself.
[EXTERNAL_DOWNLOADS]: The skill references and provides links to numerous well-known and trusted security resources, including the OWASP Top 10, PortSwigger's Web Security Academy, and various official documentation for frameworks like Django, Express.js, and Spring Boot. These references are informative and originate from authoritative industry sources.

web-app-logic