The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes the subprocess module to run several external security and reconnaissance tools.
Evidence: recon_orchestrator.py executes subfinder, amass, alterx, puredns, httpx, katana, gau, and nuclei.
Evidence: cloud_asset_enum.py executes trufflehog for GitHub secret scanning.
Evidence: breach_intel.py executes theHarvester for identity harvesting.
[EXTERNAL_DOWNLOADS]: The skill performs network requests to various well-known and reputable security services and technical databases.
Evidence: Fetches vulnerability data from services.nvd.nist.gov and api.first.org (EPSS) in cve_prioritizer.py.
Evidence: Queries CISA's KEV feed from cisa.gov.
Evidence: Probes cloud storage and identity endpoints at s3.amazonaws.com, blob.core.windows.net, storage.googleapis.com, and login.microsoftonline.com in cloud_asset_enum.py.
Evidence: Accesses haveibeenpwned.com and api.dehashed.com for credential intelligence in breach_intel.py.
[INDIRECT_PROMPT_INJECTION]: The skill has an attack surface where untrusted data from targets enters the agent context.
Ingestion points: Target JavaScript files (js_secret_hunter.py), subdomain lists (recon_orchestrator.py), and breach data (breach_intel.py).
Boundary markers: None identified.
Capability inventory: Shell command execution via subprocess.run, file system writing for logs, and network operations.
Sanitization: Data is processed primarily through regular expressions to extract endpoints and identifiers.

recon-osint