The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests and processes external data from multiple sources, which could contain malicious instructions designed to bypass constraints or manipulate agent behavior.
Ingestion points: ROE JSON files are read by scripts/scope_check.py; triage mode accepts arbitrary signal strings; report mode processes operator-supplied evidence and notes.
Boundary markers: The instructions do not specify the use of delimiters or 'ignore' instructions when interpolating external data into the prompt context.
Capability inventory: The skill can execute shell commands via local scripts (scripts/check.py), write findings to the filesystem, and generate complex methodology plans.
Sanitization: While JSON inputs are validated against schemas (e.g., references/findings-schema.md), the content is not filtered for natural language instructions.
[EXTERNAL_DOWNLOADS]: The skill provides the operator with commands to install external penetration testing tools and skills from GitHub repositories.
The scripts/pentest_policy.py script generates npx skills add commands for repositories such as hack-skills and acs.
The skill implements a security policy that forces 'document-only' or 'quarantine' status for tools identified as sensitive or potential C2 frameworks, requiring manual operator inspection.
All remote references target a well-known service (GitHub).
[COMMAND_EXECUTION]: The skill relies on several Python scripts to perform local logic and validation.
scripts/check.py uses the subprocess module to execute other bundled scripts for smoke testing and validation purposes.
These executions are restricted to local, bundled assets and do not incorporate unvalidated shell input.

pentest