The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses curl to perform network reconnaissance and fetch SAML configuration data from user-defined targets. This is standard behavior for an auditing utility.
[REMOTE_CODE_EXECUTION]: Automated scanners flagged a pattern where curl output is piped to python3. Manual verification of the source code confirms that all instances use the python3 -c flag followed by a static, hardcoded script. The remote content is read as data via sys.stdin for XML parsing and is never executed as code.
[SAFE]: The skill performs actions consistent with its stated purpose of SAML security testing. It does not attempt to exfiltrate host credentials, establish persistence, or hide its activity through obfuscation.

saml-sso-attack