The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides instructions to execute shell commands using utilities such as curl, awk, and grep. It also utilizes specialized security tools like httpx, corsy, and nuclei to perform network reconnaissance and vulnerability probing against target API endpoints.
[INDIRECT_PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection because it is designed to ingest and process data from untrusted external sources.
Ingestion points: Reads target URLs and endpoint lists from local files (e.g., recon/$TARGET/api-endpoints.txt) and processes HTTP response headers and bodies from remote servers via curl and httpx.
Boundary markers: No explicit delimiters or instructions are used to distinguish between the tool output and the agent's control logic.
Capability inventory: Includes network operations (curl, httpx), file system reads, and the ability to install and run third-party security packages.
Sanitization: There is no evidence of sanitization or escaping of the ingested data before it is processed by the agent or utilities.
[EXTERNAL_DOWNLOADS]: The skill references the installation of the corsy tool via pip3. It also includes Out-Of-Band (OOB) data exfiltration patterns in its browser PoC templates using oastify.com, which is a well-known service used for security testing and vulnerability confirmation.

hunt-cors