The Agent Skills Directory

[COMMAND_EXECUTION]: The skill makes extensive use of shell commands involving security tools such as nmap, subfinder, amass, httpx, katana, nuclei, feroxbuster, and ffuf. It directly interpolates variables like $DOMAIN and $TARGET into these commands, which creates a potential surface for command injection if inputs are not properly sanitized before execution.
[DATA_EXFILTRATION]: The methodology explicitly directs the agent to search for and identify sensitive files including .env, .bak, .sql, and .config through web crawling and GitHub dorking. It also attempts to probe cloud storage services (AWS S3, Azure Blobs, GCP Buckets) for publicly accessible or misconfigured data associated with the target domain.
[EXTERNAL_DOWNLOADS]: The skill performs multiple network operations to fetch data from external services, including certificate transparency logs (crt.sh), vulnerability databases (nvd.nist.gov), GitHub repository APIs, and breach intelligence platforms (haveibeenpwned.com).
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection as it ingests untrusted data from various external sources (e.g., GitHub repository descriptions, CVE summaries, and wayback machine URL paths) which are then processed by the agent to generate reports.
Ingestion points: External data enters the context via crt.sh, waybackurls, nvd.nist.gov, api.github.com, and haveibeenpwned.com (SKILL.md).
Boundary markers: Absent; the instructions do not provide delimiters or warnings for the agent to ignore instructions embedded within the retrieved data.
Capability inventory: The skill has access to shell execution (bash) and network operations (curl) (SKILL.md).
Sanitization: Absent; there is no evidence of filtering or escaping external content before interpolation or processing.

recon-osint