The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to analyze external, untrusted content such as web pages, tutorials, and JavaScript source code to identify vulnerabilities. This activity represents an inherent attack surface where malicious instructions could be embedded in target data to influence the agent. The skill provides proactive mitigation by instructing the agent to 'Distrust the target's own hints' and to prioritize evidence from live responses over text found on the page.
Ingestion points: Target web pages, tutorial notes on pages, and external JavaScript source files.
Boundary markers: Explicit instructions to distrust target hints and text embedded in pages.
Capability inventory: Terminal command execution via curl, sqlmap, and grep.
Sanitization: No specific input sanitization methods are described for the tools mentioned.
[COMMAND_EXECUTION]: The skill provides numerous examples of shell commands for using curl, sqlmap, and grep to perform security testing. These tools are used for their intended purpose of vulnerability research and identification on external targets.
[OBFUSCATION]: The skill includes examples of WAF bypass techniques using URL encoding (e.g., %27, %20), comment injection (e.g., /**/), and Unicode escape sequences (e.g., \u0067t). These are provided as educational examples of common bypass methods found in the field and do not represent obfuscation of the skill's own operational logic.

hunt-sqli