The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill utilizes the shodan and requests Python packages to interact with well-known security services. These are standard dependencies for threat intelligence workflows.
[DATA_EXFILTRATION]: Network activity is confined to official Shodan API endpoints (api.shodan.io and internetdb.shodan.io). No attempts to access sensitive local files (such as SSH keys or AWS credentials) or transmit data to unauthorized third-party domains were detected.
[PROMPT_INJECTION]: The skill handles untrusted external data in the form of service banners and SSL certificates. While this represents a surface for indirect prompt injection, the risk is mitigated by the lack of dangerous capabilities (no eval, exec, or subprocess calls) and the truncation of banner data to 200 characters.
Ingestion points: Remote service banners are ingested in the enrich_ip method via service.get("data", "").
Boundary markers: None explicitly defined in the script output for the LLM.
Capability inventory: Script capabilities are limited to network API requests and writing JSON to a local file.
Sanitization: The script performs length-based truncation on service banners.
[COMMAND_EXECUTION]: No suspicious command execution or shell injection patterns were identified in the provided scripts.

performing-ip-reputation-analysis-with-shodan