The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute the strix command-line tool with various arguments to perform security scans on web applications. While this is the primary purpose of the skill, it involves running external binaries and passing user-provided parameters directly into shell commands.
[DATA_EXPOSURE]: The instructions explicitly recommend passing sensitive credentials (passwords) as plain text within the --instruction command-line flag. This is a suboptimal security practice as command-line arguments can often be visible in process listings, system logs, or shell history, potentially exposing authentication data.
[INDIRECT_PROMPT_INJECTION]: The skill establishes an indirect prompt injection surface by ingesting data from untrusted external sources (web applications and GitHub repositories) and then instructing the agent to read the resulting analysis files.
Ingestion points: The agent is directed to read strix_runs/<run>/penetration_test_report.md and files within the vulnerabilities/ directory, which contain data derived from scanning external targets.
Boundary markers: There are no explicit boundary markers or instructions to treat the content of these reports as untrusted data.
Capability inventory: The agent has the capability to execute shell commands (strix) and read/write to the local file system.
Sanitization: There is no mention of sanitization or filtering of the content within the generated reports before the agent processes them.

web-app-penetration-testing