The Agent Skills Directory

[COMMAND_EXECUTION] (HIGH): The skill contains specific shell command templates for 'dalfox', a tool used to automate XSS discovery. An agent with terminal access could execute these commands against unintended targets, potentially violating terms of service or laws.
[DATA_EXFILTRATION] (HIGH): The document provides functional JavaScript payloads designed for credential and cookie theft, specifically using 'document.location' to send sensitive data to an external 'attacker.com' domain.
[REMOTE_CODE_EXECUTION] (MEDIUM): It describes methods to execute arbitrary JavaScript code using 'eval()' and 'atob()' to decode Base64 strings, which are common techniques used to bypass security filters and execute malicious payloads.
[PROMPT_INJECTION] (LOW): While primarily focused on web security, the inclusion of multiple encoding techniques (Base64, HTML entities, URL encoding) for the purpose of bypassing filters represents a risk factor for obfuscating malicious instructions directed at the agent itself.

xss-testing