The Agent Skills Directory

[SAFE]: No malicious patterns or security risks were identified in the skill. The instructions and scripts provided align with the stated purpose of a penetration testing playbook.
[COMMAND_EXECUTION]: The skill utilizes common reconnaissance tools via the shell, including subfinder, rustscan, and httpx. These are industry-standard utilities for identifying subdomains and open ports on a target system.
[EXTERNAL_DOWNLOADS]: The skill performs HTTP requests to crt.sh, which is a well-known and trusted certificate transparency log service, to extract subdomain information.
[PROMPT_INJECTION]: The skill defines a workflow that involves processing output from external tools (e.g., tech stack detection via response headers, subdomain lists). This represents a surface for indirect prompt injection if the agent were to parse malicious content as instructions; however, the risk is managed by standard LLM guardrails and is expected behavior for security analysis tools. * Ingestion points: Data extracted from crt.sh and headers captured via curl stored in subs.txt and live.txt. * Boundary markers: Not explicitly defined in the shell command sequences. * Capability inventory: Includes the use of curl, subfinder, rustscan, and httpx for target discovery. * Sanitization: No specific sanitization or filtering logic is present in the provided playbook snippets.

pentest-playbook