The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides various command-line examples, including curl for testing remote endpoints and grep for local source code auditing. These are intended for use by the agent when performing security assessments.
[DATA_EXFILTRATION]: Contains numerous payload templates for reading sensitive files such as /etc/passwd, win.ini, and cloud provider metadata. These are standard proof-of-concept patterns used to demonstrate the impact of XML External Entity vulnerabilities.
[OBFUSCATION]: Includes examples of bypass techniques such as encoding URI schemes with HTML entities (e.g., hex-encoded 'file' protocol) to evade simple keyword-based filters and Web Application Firewalls (WAF).
[INDIRECT_PROMPT_INJECTION]: As a vulnerability hunting tool, the skill is designed to ingest and parse untrusted XML data from target servers. This represents a potential attack surface for indirect prompt injection if a target server responds with malicious instructions. The analysis confirms ingestion points at XML entry points with no explicit boundary markers or sanitization, utilizing capabilities like network requests and file reads, although this is inherent to the skill's primary function.

hunt-xxe