The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the user on how to install the ffuf tool from its official GitHub repository (github.com/ffuf/ffuf).
[REMOTE_CODE_EXECUTION]: The CI/CD template (assets/ci-config-template.yml) contains a script example that downloads an installation script for tfsec from Aqua Security's official GitHub organization and pipes it directly to bash for execution. This is a common practice for automated tooling setup from well-known vendors.
[COMMAND_EXECUTION]: The skill provides numerous shell command examples for performing directory discovery, parameter fuzzing, and virtual host enumeration using ffuf. It also includes shell scripts for CI/CD automation that use standard utilities like grep, pip, and npm.
[PROMPT_INJECTION]: The skill includes an indirect prompt injection attack surface analysis. It describes workflows where an agent would process output from ffuf (which is derived from external web responses). The skill demonstrates safe practices by using filtering (grep) and structured output (JSON) to handle this data.
[CREDENTIALS_UNSAFE]: While the skill contains references to credentials (e.g., fuzzing passwords), it uses clear placeholders like FUZZ, test123, and admin within examples and security rule templates. These are not real hardcoded secrets but educational placeholders for automated testing.

dast-ffuf