The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides bash command templates that utilize standard system utilities such as curl, jq, sort, and comm. These scripts are intended for enumeration and behavioral comparison of API endpoints across different versions (e.g., v1 vs v2). All commands operate on user-defined targets and do not exhibit signs of malicious intent or unauthorized system modification.
[EXTERNAL_DOWNLOADS]: The instructions include queries to the Wayback Machine (web.archive.org) via its public CDX API to locate archived OpenAPI or Swagger specifications. This is a well-known service for archival research and its use here is consistent with the skill's stated purpose of auditing historical API surfaces.
[PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection as it ingests and processes data from external sources during the auditing workflow.
Ingestion points: Data enters the context from the target server's HTTP responses and historical metadata retrieved from the Wayback Machine.
Boundary markers: The provided bash templates do not implement specific boundary markers or instruction-ignore headers for processed data.
Capability inventory: The skill uses curl for network requests and jq for data parsing. It does not perform dynamic code execution (e.g., eval or exec) on the ingested content.
Sanitization: There is no explicit sanitization or filtering of external data content within the instructional scripts.

hunt-shadow-api