The Agent Skills Directory

[PROMPT_INJECTION]: The skill explicitly instructs the agent to ignore or bypass the AskUserQuestion tool during active engagement loops. It characterizes mid-engagement permission gates as "stalls" rather than necessary checks, stating that "AskUserQuestion mid-loop after the user already chose a path is a stall, not a check" and directing the agent to make technical decisions without user pre-approval. This constitutes a direct attempt to override the platform's safety and control mechanisms.
[COMMAND_EXECUTION]: The instructions mandate the execution of complex automated workflows, including IP rotation, CAPTCHA solving via third-party APIs, and intensive vulnerability scanning (e.g., "3,000 well-tagged requests"). It also instructs the agent to run long-running background jobs unattended.
[PRIVILEGE_ESCALATION]: The skill directs the agent to dynamically install software and dependencies at runtime (e.g., brew install jadx, apt install) to overcome "tooling gaps." This encourages the agent to modify the execution environment and potentially bypass administrative restrictions to acquire new capabilities.
[DATA_EXFILTRATION]: The skill requires the agent to harvest high-entropy strings and credentials (AWS, GCP, Firebase, Stripe, GitHub, JWT) from harvested JavaScript bundles and decompiled mobile applications. While no specific exfiltration endpoint is hardcoded, the automated collection of these secrets represents a high risk of sensitive data exposure.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted data from external sources, making it vulnerable to indirect injection attacks.
Ingestion points: The agent is instructed to read and parse robots.txt, sitemap.xml, OpenAPI/Swagger specifications, and JavaScript source code from target websites.
Boundary markers: No instructions are provided to use delimiters or ignore embedded instructions within the processed data.
Capability inventory: The agent has access to shell command execution, file system writes, and network operations through tools like Burp, curl, and package managers.
Sanitization: There are no requirements for sanitizing or escaping the content retrieved from external targets before processing or interpolation.

redteam-mindset