The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes NTLM challenge headers from external network targets, creating a vulnerability surface where malicious inputs could influence the agent's parsing logic.
Ingestion points: Remote server HTTP response headers (specifically WWW-Authenticate: NTLM) captured via raw sockets in the provided Python script.
Boundary markers: The script lacks markers or delimiters to distinguish legitimate protocol data from potentially malicious payloads embedded in the challenge string.
Capability inventory: Raw network socket access, Python script execution, and binary buffer manipulation.
Sanitization: The script performs regex matching and Base64 decoding but fails to validate internal protocol offsets (tn_off, ti_off) and lengths (tn_len, ti_len) extracted from the NTLMSSP header before using them to slice memory buffers.
[DYNAMIC_EXECUTION]: The Python script implements insecure cryptographic practices when interacting with external hosts.
Evidence: The script explicitly disables SSL/TLS certificate validation by setting ctx.check_hostname = False and ctx.verify_mode = ssl.CERT_NONE. This configuration exposes the agent to Man-in-the-Middle (MitM) attacks, allowing an adversary to intercept or modify communication during the reconnaissance process.
[COMMAND_EXECUTION]: The skill provides both shell commands (curl) and a full Python script intended for execution by the agent to perform network reconnaissance and data capture.

hunt-ntlm-info