The Agent Skills Directory

COMMAND_EXECUTION (HIGH): The execute_command function defined in references/tools.md allows the agent to execute arbitrary shell commands. This is a critical security risk as it provides the AI with unrestricted access to the underlying operating system, bypassing intended tool-specific boundaries.
REMOTE_CODE_EXECUTION (HIGH): The skill includes specialized functions for exploitation, such as ai_generate_payload, generate_exploit_from_cve, and ai_test_payload. These tools facilitate the creation, delivery, and execution of malicious code, which can be leveraged for attacks beyond the scope of passive reconnaissance.
PROMPT_INJECTION (LOW): The skill is highly susceptible to Indirect Prompt Injection (Category 8) due to its core workflow of processing untrusted external data.
Ingestion points: Data from amass, subfinder, httpx, and theharvester in references/tools.md which crawl external web content and metadata.
Boundary markers: No delimiters or instructions to ignore embedded commands are present in the workflows.
Capability inventory: The agent has access to execute_command, sqlmap_scan, and nuclei_scan, providing a dangerous path for an attacker to influence the agent into attacking secondary targets or the host itself.
Sanitization: There is no evidence of sanitization or validation of the data retrieved from external scans before it is processed by the agent.
DATA_EXFILTRATION (LOW): The skill uses tools like amass and subfinder that perform network operations to external domains. When combined with execute_command, these capabilities can be used to exfiltrate local files or credentials harvested during the OSINT process.

pentest-osint-recon