The Agent Skills Directory

[COMMAND_EXECUTION]: The skill includes multiple functional Python scripts for SMTP communication and mail spoofing, including DKIM signature generation. It also provides specific command lines for executing powerful security tools such as hydra for credential brute-forcing and nmap with vulnerability-specific scripts targeting various mail transfer agents.
[DATA_EXFILTRATION]: The skill explicitly describes techniques for using the SMTP protocol as a covert channel for exfiltrating data, providing a methodology for encoding data into email bodies or attachments when standard outbound channels are blocked.
[EXTERNAL_DOWNLOADS]: Recommends the installation of third-party security tools and libraries from external sources, including checkdmarc, dkimpy, swaks, and sendEmail, and references the mailspoof tool hosted on GitHub.
[PROMPT_INJECTION]: The skill creates an indirect prompt injection surface by instructing the agent to process and interpret untrusted output from remote SMTP servers.
Ingestion points: Network service banners (Phase 1), user enumeration responses (Phase 2), and reports from automated scanners described in SKILL.md and references/smtp-commands.md.
Boundary markers: Absent; the instructions do not include delimiters or warnings to treat external data as untrusted or to ignore embedded instructions.
Capability inventory: The skill provides the agent with access to shell commands (nc, openssl, nmap, dig, swaks, hydra) and Python script execution capabilities for network interaction.
Sanitization: No evidence of input validation, escaping, or filtering is present before the agent interpolates or processes response data from external network targets.

smtp-pentesting