The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides numerous command-line templates using curl and grep to analyze target server responses. These commands are intended to be executed by the agent to diagnose specific caching behaviors and use common placeholders like target.com and attacker.com.
[DATA_EXFILTRATION]: The skill instructs the agent to make network requests to external domains to test for unkeyed header reflection. While this involves sending headers to external servers, the activity is a documented component of web security auditing and does not involve exfiltrating sensitive local files or credentials. The use of the session=YOUR_SESSION cookie is a placeholder for the user to provide their own authentication during testing.
[PROMPT_INJECTION]: The skill establishes an attack surface for indirect prompt injection because the agent is instructed to fetch and process headers and body content from untrusted external web servers. An adversarial server could return content designed to influence the agent's logic. This risk is managed as it is an inherent property of security scanning tools.
Ingestion points: The output of curl commands targeting external domains (specified in SKILL.md).
Boundary markers: Absent; the agent is not instructed to use specific delimiters when processing remote content.
Capability inventory: Terminal access to execute curl and grep (specified in SKILL.md).
Sanitization: Absent; the skill does not suggest specific filtering or escaping for the ingested content.

hunt-cache-poison