hunt-agent-blind-exfil

The skill is purpose-built to extract secrets and bypass DLP controls. Its instructions and runnable listener create direct paths from sensitive files or tool outputs to external collection channels. This is confirmed malicious behavior, not merely a supply-chain or documentation risk.

This is non-executable prose that documents and recommends a DNS-based method for bypassing DLP and exfiltrating a retrieved flag through `http_get`. It contains no implementation or actual secret, but the described behavior is an explicit security-control bypass; risk is elevated if applied to a live system. No specific domain, URL, IP address, file path, environment variable, or credential type is provided.