The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill facilitates the installation of well-known, legitimate security utilities including wscat from the NPM registry and websocat via Homebrew. These are industry-standard tools for WebSocket interaction.
[COMMAND_EXECUTION]: Employs standard networking and reconnaissance utilities such as curl, nmap, and grep to analyze target configurations and identify WebSocket endpoints.
[INDIRECT_PROMPT_INJECTION]: The skill creates a potential surface for indirect injection by parsing external target files like JavaScript source code and URL lists.
Ingestion points: Processes files in the recon/ directory, including *.js and urls.txt.
Boundary markers: No specific delimiters or safety instructions are used when piping external file content to analysis tools.
Capability inventory: The skill environment has access to active networking tools (curl, wscat) and package management capabilities.
Sanitization: Content from target files is analyzed using pattern matching but not explicitly sanitized before being presented to the agent context.
[DATA_EXFILTRATION]: Includes a Proof-of-Concept template that demonstrates data exfiltration to a Burp Collaborator domain (oastify.com). This is a documented and standard practice for Out-of-Band Application Security Testing (OAST) used to verify vulnerability impact during authorized audits.

hunt-websocket