The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to utilize standard security CLI tools for auditing purposes, including 'curl' for verifying HTTP request headers, 'ffuf' for fuzzing parameters and performing brute-force testing, and 'hashcat' for offline token cracking.
[DYNAMIC_EXECUTION]: Includes Python code snippets for local JWT manipulation (e.g., python3 -c 'import jwt; ...') to demonstrate vulnerability testing techniques like algorithm confusion or weak secret checks.
[INDIRECT_PROMPT_INJECTION]: As the skill involves processing responses from external targets using network auditing tools, it contains an inherent attack surface for indirect prompt injection. * Ingestion points: Responses from target servers retrieved via 'curl' or 'ffuf' (SKILL.md). * Boundary markers: Not defined in the instructions to prevent the agent from interpreting target data as instructions. * Capability inventory: The skill utilizes subprocess execution for network tools and scripting environments (curl, ffuf, python3, hashcat, dig) (SKILL.md). * Sanitization: No explicit output sanitization or schema validation is documented for external data processing.

hunt-ato