The Agent Skills Directory

[COMMAND_EXECUTION]: The skill makes extensive use of local shell commands to perform security testing and exploitation tasks.
Evidence includes instructions to use curl for interacting with targets and injecting payloads into logs (e.g., curl -s "http://target/" -H "User-Agent: ...").
It utilizes python3 -c for inline parameter fuzzing and scanning (e.g., python3 -c "import requests;[...] requests.get(f'http://TARGET/...')").
It employs specialized security tools like ffuf for directory and parameter discovery.
[EXTERNAL_DOWNLOADS]: The skill instructs the agent to download and use external tools from third-party repositories.
It directs the agent to clone the php_filter_chain_generator repository from GitHub (https://github.com/synacktiv/php_filter_chain_generator.git) to generate RCE payloads. While the source is a recognized security research organization, it is an external dependency.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a vulnerability surface for indirect prompt injection due to its core functionality of interacting with untrusted external systems.
Ingestion points: Untrusted data enters the agent context through the outputs of curl, requests.get, and ffuf when scanning or reading files from external targets (e.g., reading access.log or etc/passwd).
Boundary markers: There are no explicit instructions to use delimiters or sanitization when the agent processes the output of these commands.
Capability inventory: The agent is granted capabilities including shell access (curl, python3, git, ssh) and file system operations, which could be abused if the agent interprets instructions embedded in the target's data.
Sanitization: The skill lacks mechanisms to sanitize or filter the content retrieved from external targets before it is processed by the agent.

lfi-rfi-methodology