The Agent Skills Directory

[DYNAMIC_EXECUTION]: The utility scripts/dashboard.py uses subprocess.run() to execute a companion script, h1_reference.py. The command is built using a list of arguments, which prevents shell-based command injection, and utilizes the system's Python interpreter for local inter-process communication.- [UNVERIFIABLE_DEPENDENCIES_AND_REMOTE_CODE_EXECUTION]: The skill includes instructions in references/tooling-install.md for installing various security tools from reputable open-source projects (e.g., ProjectDiscovery, OWASP). These installation methods (such as go install or git clone) are intended for manual execution by the operator and represent standard setup procedures for the reconnaissance tools mentioned.- [DATA_EXPOSURE_AND_EXFILTRATION]: The toolkit interacts with external security APIs, including HackerOne and breach intelligence providers like HudsonRock, to aggregate reconnaissance information. It provides clear guidance to avoid leaking sensitive credentials into cloud-based LLM environments and prioritizes read-only validation of discovered secrets.- [INDIRECT_PROMPT_INJECTION]: The skill processes data from external sources, such as API results and web probe responses. While this creates a potential surface for indirect prompt injection, the risk is minimal given the technical nature of the ingested data and the skill's primary focus on asset discovery and technical reporting.

offensive-osint