The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses various command-line tools such as curl, ffuf, wfuzz, and dotdotpwn to perform security testing and reconnaissance on target applications.
[EXTERNAL_DOWNLOADS]: It fetches the php_filter_chain_generator tool from the official GitHub repository of Synacktiv, a well-known security research organization.
[REMOTE_CODE_EXECUTION]: The skill provides instructions to execute a Python script downloaded from an external source to generate complex Local File Inclusion (LFI) exploit payloads.
[DATA_EXFILTRATION]: It outlines methods for Out-of-Band (OOB) data exfiltration using Burp Collaborator to confirm blind vulnerabilities by triggering external network requests from the target system.
[INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection as it processes untrusted data from external targets.
Ingestion points: Target responses (headers, file contents) processed by tools like curl, ffuf, and wfuzz.
Boundary markers: Absent in the instructional workflow.
Capability inventory: Includes shell execution, network operations, and access to sensitive file paths.
Sanitization: No specific sanitization or validation of target-provided content is described.

hunt-lfi