The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill presents an attack surface for indirect prompt injection because it processes untrusted data from external targets.
Ingestion points: The workflow involves downloading and analyzing JavaScript files from target domains, mapping API endpoints, and inspecting HTTP response bodies for anomalies.
Boundary markers: There are no explicit instructions or delimiters defined to prevent the agent from following instructions that might be embedded within the files or responses retrieved from external targets.
Capability inventory: The skill framework grants the agent the ability to suggest and guide the execution of numerous shell commands and scripts (e.g., curl, nuclei, ffuf, and custom python/bash scripts) based on the analysis of external data.
Sanitization: The instructions do not specify any validation, filtering, or escaping of the content retrieved from target systems before it is evaluated by the model.
[COMMAND_EXECUTION]: The skill provides a large inventory of shell commands for the user to execute as part of the security testing workflow. This includes standard tools such as subfinder, amass, httpx, katana, and nuclei, as well as vendor-specific scripts like tools/lead_board.py, tools/hunt.py, and tools/bypass_403.sh.
[EXTERNAL_DOWNLOADS]: The skill facilitates the download of assets from external targets for analysis, including JavaScript files, hidden parameters, and cloud resource metadata. While these downloads are directed at the testing targets, they constitute the ingestion of external code into the agent's context.

bb-methodology