The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill uses standard package managers to install well-known security tools.
Evidence: pip3 install sslyze and brew install testssl in SKILL.md.
[REMOTE_CODE_EXECUTION]: Automated scanners flagged a potential remote code execution pattern via a pipe to Python. Analysis confirms this is a false positive as the command python3 -m json.tool is a standard utility for pretty-printing JSON data, not for executing arbitrary code.
Evidence: curl -s "https://hstspreload.org/api/v2/status?domain=$TARGET" | python3 -m json.tool in SKILL.md.
[DATA_EXFILTRATION]: The skill performs network requests to well-known security research services for domain and certificate status checks. These are routine investigative operations and do not involve sensitive local data.
Evidence: Requests to hstspreload.org, crt.sh, securityheaders.com, mxtoolbox.com, and dmarcian.com in SKILL.md.
[INDIRECT_PROMPT_INJECTION]: The skill ingests data from external APIs (like CT logs and HSTS status). However, it uses specific filtering (e.g., grep -oP, sed) to extract expected data fields rather than blindly interpolating raw output into agent instructions, which reduces the attack surface.
Evidence: Extraction patterns like grep -oP '"name_value": "\K[^"]+' in the Certificate Transparency section of SKILL.md.

hunt-tls-network