The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes the Bash tool to execute several standard reconnaissance commands, including whois, dig, and exiftool. It also uses curl to fetch data from the crt.sh certificate transparency log. These are expected tools for the stated purpose of OSINT collection.
[EXTERNAL_DOWNLOADS]: The skill performs network requests to external services like crt.sh using curl and utilizes WebSearch and WebFetch to gather information. These operations target well-known public data sources and are documented within the skill's instructions.
[INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection as it ingests untrusted data from multiple external sources.
Ingestion points: Data is collected via WebSearch, WebFetch, curl (fetching JSON from crt.sh), and exiftool (reading metadata from public files).
Boundary markers: The instructions provide high-level ethical guidelines for the agent but lack explicit technical delimiters to separate untrusted external data from the agent's core instructions.
Capability inventory: The skill has access to Bash, WebFetch, and Write tools across its instructions, allowing it to execute commands, perform network operations, and write files based on processed data.
Sanitization: There is no evidence of sanitization or filtering of the content retrieved from external sources before it is processed by the agent.

iblai-vibe-security-osint-recon