The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides ready-to-use shell command templates for tools like ffuf and curl. These are intended to automate authentication bypass testing, such as brute-forcing 1,000,000 six-digit OTP combinations and testing for rate-limiting deficiencies on sensitive endpoints.
[DYNAMIC_EXECUTION]: The skill includes an embedded Python script that uses asyncio and aiohttp to perform concurrent HTTP requests. This script is designed to trigger race conditions (Time-of-Check to Time-of-Use) in MFA verification logic by firing multiple submissions of the same code simultaneously.
[INDIRECT_PROMPT_INJECTION]: The skill's primary function involves analyzing responses from external, untrusted web targets, which creates a vulnerability surface for indirect prompt injection.
Ingestion points: The agent is instructed to capture and interpret HTTP response headers and bodies (e.g., changing success/failure flags or observing session states) from arbitrary targets.
Boundary markers: There are no boundary markers or instructions to treat external data as non-executable/non-instructional content.
Capability inventory: The skill possesses significant capabilities, including shell command execution (ffuf, curl) and a Python runtime with networking access, which could be exploited if a target response contains malicious instructions interpreted by the agent.
Sanitization: The skill lacks sanitization logic or validation steps for the external data it processes.

hunt-mfa-bypass