The Agent Skills Directory

[COMMAND_EXECUTION]: The skill includes shell command examples using curl to inspect HTTP response headers (e.g., Content-Security-Policy, Access-Control-Allow-Origin, and X-Frame-Options). These commands are used for passive reconnaissance and do not involve executing untrusted remote code or exfiltrating sensitive data.
[PROMPT_INJECTION]: No malicious instruction overrides or safety bypass attempts were detected. The skill uses standard instructional patterns and emphasizes the importance of authorization and isolated testing environments.
[EXTERNAL_DOWNLOADS]: The instructions mention industry-standard security tools such as 'Param Miner' and 'Burp Smuggler', but they do not contain commands to download or install software from untrusted sources.
[DATA_EXFILTRATION]: No patterns for unauthorized data access or transmission to external domains were found. The mention of localStorage and sessionStorage is strictly within the context of identifying client-side sources for DOM XSS vulnerabilities.
[DYNAMIC_EXECUTION]: While the skill discusses sinks like eval() and Function(), it does so solely to guide the identification of vulnerabilities in the target application's code, rather than utilizing these functions within its own execution logic.

client-side-exploitation