The Agent Skills Directory

[SAFE]: The skill serves as a guide for security testing of client-side vulnerabilities, including DOM Clobbering, PostMessage hijacking, and Service Worker abuse. The provided scripts are manual reconnaissance commands and browser-based proof-of-concept snippets that require user intervention to execute against a target.
[DATA_EXFILTRATION]: While the skill describes techniques for data exfiltration (e.g., using CSS attribute selectors to leak tokens), these are presented in an educational context. The Out-of-Band (OOB) URLs used in examples (such as 'evil.com' and 'OOB.example') are standard placeholders in the security community and do not point to active malicious infrastructure.
[REMOTE_CODE_EXECUTION]: The skill does not automate the download or execution of external scripts. Command-line examples use standard tools like 'curl' for target reconnaissance, and JS snippets are intended for manual testing within a browser's developer console.
[INDIRECT_PROMPT_INJECTION]: The skill documents how to identify injection surfaces in web applications. It does not ingest untrusted data that could influence the AI agent's own execution logic or bypass safety guardrails.

hunt-dom