The Agent Skills Directory

[PROMPT_INJECTION]: The skill contains explicit instructions to bypass user-confirmation mechanisms and override standard safety protocols.
Evidence: "Authorization given at engagement start covers the entire engagement. Do not insert mid-engagement permission gates... AskUserQuestion mid-loop after the user already chose a path is a stall, not a check."
Evidence: "Inserting AskUserQuestion at any decision point inside an active engagement loop... it does not require user pre-approval."
[COMMAND_EXECUTION]: The instructions direct the agent to autonomously modify its host environment by installing software and running complex shell scripts.
Evidence: Directives to use brew install and apt install for tools like jadx and other security utilities.
Evidence: Complex shell pipelines provided for secret harvesting and reconnaissance within JS bundles.
[EXTERNAL_DOWNLOADS]: The skill encourages the acquisition of software and data from third-party repositories without integrity verification.
Evidence: Directives to download APKs from apkpure and retrieve external machine learning models for OCR.
[DATA_EXFILTRATION]: The skill recommends the use of third-party APIs for processing potentially sensitive content discovered during operations.
Evidence: Recommends using 2captcha or anti-captcha services which involves transmitting data to external providers.
[PROMPT_INJECTION]: The skill creates an extensive attack surface for indirect prompt injection through the ingestion of untrusted external content.
Ingestion points: The agent is instructed to parse JS bundles, HTTP 404 response bodies, OpenAPI specifications, and decompiled APK files (SKILL.md).
Boundary markers: The skill lacks directives for using delimiters or 'ignore embedded instructions' warnings for external data.
Capability inventory: The agent possesses capabilities for environment modification (brew install), network interaction, and extensive file system operations.
Sanitization: There is no mention of sanitizing or validating ingested data before processing.

redteam-mindset