The Agent Skills Directory

[COMMAND_EXECUTION]: The Python framework implemented in SKILL.md and references/automated-penetration-testing-framework.md invokes the testssl.sh security tool via subprocess.run to evaluate target SSL/TLS configurations.
[EXTERNAL_DOWNLOADS]: The implementation examples in the skill require standard libraries such as requests for Python and axios for Node.js to manage HTTP communications during security scans.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection. 1. Ingestion points: PenetrationTester.run_full_pentest and BurpSuiteAutomation.startScan ingest content from target URLs and the Burp API. 2. Boundary markers: No delimiters or warnings are used when processing external responses. 3. Capability inventory: The skill uses subprocess.run and writes results to the local filesystem. 4. Sanitization: No sanitization or validation of ingested content is performed before storage or report generation.
[SAFE]: The skill contains various security testing payloads, including SQL injection strings and XSS scripts, as well as a list of common default credentials. These are functional components for the skill's primary purpose of vulnerability assessment.

penetration-testing