The Agent Skills Directory

[Command Execution] (MEDIUM): The skill facilitates the execution of powerful security tools (nmap, sqlmap, nikto, dirb) for vulnerability discovery and exploitation. While these are appropriate for the skill's primary purpose of penetration testing, they pose a significant risk if directed at unauthorized targets by an agent.
[Data Exposure & Exfiltration] (LOW): The inclusion of a directory traversal payload (curl .../etc/passwd) demonstrates a pattern for accessing sensitive system files, which could be misused to expose local or remote system secrets.
[Indirect Prompt Injection] (LOW): The skill is inherently vulnerable to indirect injection as it processes data from external targets (URLs and domains) without sanitization. Evidence: 1. Ingestion points: CLI tools process responses from external target URLs. 2. Boundary markers: No delimiters or ignore-instructions are present in the command templates. 3. Capability inventory: High-privilege network and command execution capabilities (sqlmap, nmap). 4. Sanitization: None; output from tools is processed directly in the agent's context.

penetration-testing