The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides numerous pre-configured curl commands and a Python script designed to interact with remote targets. These commands allow the agent to perform network reconnaissance and probe for vulnerabilities such as information disclosure (trace.axd, elmah.axd) and WCF service enumeration.
[INDIRECT_PROMPT_INJECTION]: The skill implements a significant attack surface for indirect prompt injection by ingesting data from untrusted external sources.
Ingestion points: The Python script in SKILL.md uses requests.get() and requests.post() to fetch content from remote URLs. The curl commands similarly retrieve remote data into the agent's context.
Boundary markers: There are no boundary markers or instructions to ignore embedded commands within the data ingested from external targets.
Capability inventory: The skill possesses network operation capabilities via curl and the Python requests library.
Sanitization: Data retrieved from remote servers is parsed using regular expressions (e.g., re.search) but is not sanitized, escaped, or validated before being processed or displayed to the user.

hunt-aspnet