The Agent Skills Directory

[PROMPT_INJECTION]: The skill contains an indirect prompt injection surface as it processes external target data (URLs and parameters) to construct SQL exploitation payloads.
Ingestion points: User-provided target parameters and URLs in Step 1 are used as inputs for payload generation.
Capability inventory: The skill provides instructions for data extraction using SQL payloads and includes examples for using the sqlmap command-line tool.
Boundary markers: There are no explicit delimiters or sanitization instructions for how the agent should handle potentially malicious embedded content within the target data.
Sanitization: No sanitization logic is present for input data.
[DATA_EXFILTRATION]: Provides payloads for Out-of-Band (OOB) data extraction via DNS and HTTP. These payloads reference oastify.com, which is the official domain for Burp Suite's Collaborator service, a standard tool for security testing.
[COMMAND_EXECUTION]: Includes specific command-line examples for sqlmap, an automated SQL injection tool, and instructs the agent to save evidence files to the local engagement/evidence/ directory.
[NO_CODE]: The skill consists entirely of instructional markdown and example commands; it does not contain or execute any embedded scripts or binary files.

sql-injection-blind