The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/check.py utilizes subprocess.run to execute internal validation scripts (scope_check.py, findings_emit.py, doctor.py) for smoke testing and asset verification. These calls are well-contained, using explicit paths to the Python executable and bundled scripts without shell interpolation.
[SAFE]: The skill implements a mandatory 'Scope Gate' mechanism. Before the agent provides any testing checklists (e.g., for web, api, or network phases), it is instructed to run scripts/scope_check.py to verify the target against a signed ROE document. This enforces a strict authorization boundary.
[SAFE]: Robust policy enforcement is integrated into the skill's logic. scripts/pentest_policy.py and scripts/doctor.py include blocklists and heuristics to detect and refuse requests involving C2 frameworks, webshells, or unauthorized offensive operations. Sensitive tools are restricted to a 'document-only' status, preventing automated installation.
[SAFE]: The skill ingests user-supplied ROE JSON files. The parser in scripts/scope_check.py performs rigorous validation and normalization on this data (e.g., URL normalization, CIDR parsing, and expiration checks), effectively mitigating risks associated with untrusted data ingestion.

pentest