The Agent Skills Directory

[COMMAND_EXECUTION]: The skill includes instructions for running local scripts (secret_scan.py and h1_reference.py) to perform reconnaissance tasks.
[EXTERNAL_DOWNLOADS]: The h1_reference.py script makes network requests to hackerone.com using Python's urllib.request. This is a well-known service used for security research and report disclosure, and the script uses public APIs without requiring credentials.
[DATA_EXPOSURE]: The secret_scan.py script is designed to detect sensitive patterns (API keys, private keys, etc.) in local files. The output is provided to the user via stdout/JSONL and no evidence of exfiltration to external domains was found.
[REMOTE_CODE_EXECUTION]: No remote code execution patterns were detected. The scripts only execute locally on the user's machine using provided paths or stdin.
[PROMPT_INJECTION]: The skill instructions (README.md) focus on operational triggers for OSINT tasks and do not attempt to bypass agent safety filters or override core instructions.

offensive-osint