The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill provides instructions to download the ffuf tool and SecLists wordlists from GitHub repositories. These downloads originate from well-known community resources.
[CREDENTIALS_UNSAFE]: The resources/REQUEST_TEMPLATES.md file contains hardcoded example JWT tokens and API key strings. These are provided as documentation placeholders to demonstrate the configuration of authenticated requests.
[COMMAND_EXECUTION]: The skill includes a Python helper script (ffuf_helper.py) and provides instructions for its execution to analyze JSON results and generate wordlists.
[INDIRECT_PROMPT_INJECTION]: The skill's analysis workflow involves processing untrusted data, which presents a surface for indirect prompt injection.
Ingestion points: The ffuf_helper.py script ingests results.json, which contains URLs and response metadata captured from external web targets during fuzzing.
Boundary markers: The script and instructions lack explicit delimiters or warnings to ignore potentially malicious instructions embedded in the captured web data.
Capability inventory: The skill utilizes network fuzzing tools and file system operations to process and store scan results.
Sanitization: No sanitization is performed on the captured web data before it is presented to the agent for analysis.

ffuf-web-fuzzing