The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill instructs the user or agent to install the Strix tool by downloading a script from https://strix.ai/install and piping it directly into bash. This pattern executes remote code with the full privileges of the current user environment without prior local inspection.
[EXTERNAL_DOWNLOADS]: The skill performs several network operations to external domains including strix.ai for software installation and app.strix.ai for Cloud API interaction, asset registration, and data retrieval.
[COMMAND_EXECUTION]: The skill uses the strix CLI tool to perform scanning operations and executes various shell commands for Docker status checks and environment variable configuration (e.g., export STRIX_LLM, export LLM_API_KEY).
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it is designed to ingest and process data from untrusted external sources.
Ingestion points: Untrusted data enters the agent context via target URLs, repository URLs, and local file paths passed to the --target or --mount arguments in SKILL.md.
Boundary markers: The instructions do not define clear boundaries or delimiters to separate instructions from the data found at the target locations.
Capability inventory: The skill has the capability to execute subprocesses (via the strix CLI) and perform network operations (via curl to the Cloud API).
Sanitization: There is no evidence of sanitization or filtering to prevent malicious instructions embedded in a target codebase or web page from influencing the agent's behavior during a scan.

strix-pentest