The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions frequently use sudo for networking and installation tasks, such as sudo nmap and sudo apt install. This indicates a requirement for the agent to operate with elevated system privileges.
[COMMAND_EXECUTION]: Includes advanced bash networking techniques, specifically using file descriptors to open raw TCP connections (e.g., exec 3<>/dev/tcp/...) for direct interaction with the Asterisk Manager Interface (AMI).
[CREDENTIALS_UNSAFE]: Identifies numerous configuration files that commonly contain hardcoded, plain-text credentials, such as sip.conf (SIP passwords), manager.conf (AMI passwords), and Elastix.conf (MySQL and Web admin passwords).
[DATA_EXFILTRATION]: Instructs the agent to access and read sensitive configuration files in restricted system directories (e.g., /etc/asterisk/, /etc/amportal.conf) to harvest credentials and system topology information.
[REMOTE_CODE_EXECUTION]: Describes methods to execute arbitrary shell commands on target systems by modifying Asterisk dialplans to use the System() or Shell() functions.
[PROMPT_INJECTION]: The skill contains instructional patterns that could be used to override default agent behaviors, such as specifying custom User-Agents (e.g., friendly-scanner) or instructing the agent to ignore certain network behaviors.
[INDIRECT_PROMPT_INJECTION]: The skill exhibits a significant attack surface for indirect injection as it is designed to ingest and process untrusted data from network scan outputs, SIP response headers, and external PCAP capture files.
Ingestion points: Network scanning tool outputs (nmap, svmap), SIP header fields, and PCAP files.
Boundary markers: None identified in the prompt interpolation logic.
Capability inventory: Subprocess execution for numerous CLI tools (nmap, sippts, multimon, etc.), file system read/write, and raw network socket access.
Sanitization: No evidence of output sanitization or validation before processing tool results.

voip-pentesting