The Agent Skills Directory

[COMMAND_EXECUTION]: Automated execution of the hashcat utility.\n
Evidence: scripts/agent.py uses subprocess.run to execute the system binary.\n
Context: It correctly passes arguments as a list, which prevents shell injection vulnerabilities.\n- [COMMAND_EXECUTION]: Generation of command-line strings for manual execution.\n
Evidence: scripts/process.py provides a generate_hashcat_command function that returns a joined string of command arguments.\n
Context: Users should be aware that executing these strings in a shell requires input sanitization if source filenames are untrusted.\n- [DATA_EXFILTRATION]: Access to sensitive cryptographic material.\n
Evidence: The scripts read and parse files containing hashes and cracked passwords (potfiles).\n
Evidence: scripts/agent.py writes output to the temporary directory at /tmp/hashcat_out.txt.\n- [EXTERNAL_DOWNLOADS]: References to official security tools and wordlists.\n
Evidence: references/standards.md links to official GitHub repositories for Hashcat and common wordlists like SecLists.\n
Context: These are well-known resources in the cybersecurity community and are considered safe sources.\n- [PROMPT_INJECTION]: Vulnerability to indirect instruction injection through processed data.\n
Ingestion points: Hash files and potfiles read by scripts/agent.py and scripts/process.py.\n
Boundary markers: Absent; the scripts parse file lines directly without explicit instruction-filtering delimiters.\n
Capability inventory: Capability to execute subprocesses (agent.py) and write files (process.py).\n
Sanitization: Basic validation using regex patterns for hash identification.

performing-hash-cracking-with-hashcat