The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests and processes data from external, untrusted web servers.
Ingestion points: Phase 1 downloads HTML and JavaScript content from a user-specified target host.
Boundary markers: The skill does not implement boundary markers or explicit instructions to the agent to ignore potentially malicious instructions embedded in the target's response data.
Capability inventory: The agent has access to terminal capabilities, including network requests (curl) and script execution (python3).
Sanitization: While a regular expression (/ISAPI/[A-Za-z0-9_/]+) is used to filter extracted strings, it is not a robust defense against sophisticated injection attacks designed to resemble valid API paths.
[REMOTE_CODE_EXECUTION]: The skill utilizes dynamic execution of a Python script to process target data.
Evidence: The script in Phase 1 is executed via python3 -c, passing a multi-line string as the script body.
Risk: Piping untrusted data from a curl command directly into a Python script's standard input for processing creates a vulnerability surface if the script logic contains flaws or if the data can influence the execution flow.
[COMMAND_EXECUTION]: The skill dynamically constructs and executes shell commands using data extracted from untrusted web content.
Evidence: The Quick Detection section and Phase 1 parse script tags from HTML and pass the resulting URLs into subsequent curl commands.
Risk: If a malicious target provides crafted script paths, it could lead to unexpected network operations or resource fetching in the local environment.

scada-hikvision-isapi