The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes shell commands to interact with remote targets and process results. It uses curl to send injection payloads in Phases 1 through 5, and ldapsearch for verifying results in Phase 6.
[DYNAMIC_EXECUTION]: Uses inline Python snippets to dynamically format and process data. Evidence includes python3 -c using json.dumps for payload formatting, urllib.parse.quote for encoding XPath strings, and JSON parsing of search results.
[INDIRECT_PROMPT_INJECTION]: The skill ingests data from external targets, creating an attack surface. 1. Ingestion points: HTTP response bodies and metadata from curl commands targeting external hosts in Phases 1-5. 2. Boundary markers: No specific boundary markers are used to delimit external data. 3. Capability inventory: Network operations (curl, ldapsearch) and script execution (python3, bash). 4. Sanitization: The skill encodes outgoing data but lacks sanitization for incoming target responses before they are processed by the agent.

hunt-ldap