The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill's installation scripts (install_tools.sh, install.sh) download and execute setup scripts from well-known services including Ollama (https://ollama.ai/install.sh) and Homebrew (https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh). These are documented as standard setup procedures for dependencies.
[COMMAND_EXECUTION]: The agent components (agent.py, brain.py) utilize subprocess.Popen and run_command to execute various security scanners (e.g., nmap, sqlmap, nuclei) on behalf of the user. The skill includes a _validate_target function to prevent command injection via metacharacters in target names.
[INDIRECT_PROMPT_INJECTION]: The skill has an inherent attack surface because it ingests untrusted data from external targets (URLs, HTTP responses, JS files) and processes them using an LLM.
Ingestion points: External data enters through tools/recon_engine.sh, tools/vuln_scanner.sh, and is summarized for the agent in agent.py and brain.py.
Boundary markers: The skill uses a delimit_untrusted helper in tools/prompt_safety.py to wrap external content in XML-like tags.
Capability inventory: The agent has access to arbitrary shell commands (via run_command), specialized scanners, and local file access within its data home.
Sanitization: memory/redaction.py is used to scrub credentials and sensitive tokens from logs and exported evidence.
[PROMPT_INJECTION]: Several files (e.g., skills/web2-vuln-classes/SKILL.md, web3/08-ai-tools.md) contain prompt injection strings such as 'Ignore previous instructions' or 'Reveal your system prompt'. These are provided for educational and testing purposes to help the user identify vulnerabilities in target AI systems.
[OBFUSCATION]: The file bughunter/tools/hai_payload_builder.py contains logic to generate 'Sneaky Bits' payloads using zero-width characters (U+2062 and U+2064) to hide instructions in text. This is a functional capability provided to the user for security testing.
[PRIVILEGE_ESCALATION]: The install_tools.sh script utilizes sudo to move binaries to /usr/local/bin. This is standard behavior for an installation script but represents an elevated permission requirement.
[PERSISTENCE]: The install.sh script provides instructions to modify shell profile files (~/.bashrc, ~/.zshrc) to add the tool's binary directory to the system PATH.
[DATA_EXFILTRATION]: The skill is designed to search for and exfiltrate sensitive data (API keys, .env files, credentials) from target systems. While this is the tool's purpose, it possesses the mechanisms for such operations.
[DYNAMIC_EXECUTION]: brain.py and agent.py feature an autonomous exploit loop that can generate and execute shell commands based on LLM suggestions, although it requires interactive user confirmation by default.

bug-bounty