The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill references an external tool for generating PHP filter chains from the Synacktiv GitHub repository. This is a reference to a well-known security research organization for the purpose of vulnerability exploitation on a target.- [COMMAND_EXECUTION]: The methodology involves using common security command-line tools such as 'ffuf', 'gf', 'wfuzz', and 'dotdotpwn' for reconnaissance and identifying potential vulnerability sinks.- [DATA_EXFILTRATION]: The skill identifies sensitive system files and cloud credentials (e.g., '/etc/passwd', '~/.aws/credentials') as high-value targets for file inclusion tests. These are used as markers to confirm successful vulnerability exploitation on the target system.- [INDIRECT_PROMPT_INJECTION]: The skill describes a process that ingests data from external target web applications, creating a potential surface for indirect prompt injection.
Ingestion points: Target server HTTP responses and file contents read through LFI/RFI parameters (SKILL.md).
Boundary markers: Includes validation discipline such as OOB confirmation and direct-read checks to distinguish genuine content from reflected input.
Capability inventory: Shell command execution for reconnaissance and script execution ('git', 'python3') as part of the scanning process.
Sanitization: Suggests using 'php://filter/convert.base64-encode' when reading source files to ensure the agent processes raw data as a string rather than interpreting it.

hunt-lfi