The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from public Certificate Transparency (CT) logs through the crt.sh and Certstream APIs. This creates a potential surface where malicious instructions or formatting could be passed to the agent.
Ingestion points: Certificate data is ingested from crt.sh and Certstream in SKILL.md (Steps 1, 2, and 3) and scripts/agent.py (query_crtsh function).
Boundary markers: The skill does not implement delimiters or safety instructions to distinguish between the agent's instructions and the untrusted domain data being processed.
Capability inventory: The skill possesses network access capabilities (requests) and file system write access (writing markdown reports via open() in SKILL.md Step 4).
Sanitization: There is no evidence of sanitization or escaping of the certificate fields (Common Names, Subject Alternative Names) before they are interpolated into the generated markdown intelligence reports, which could lead to markdown injection if viewed by another automated agent.
[OBFUSCATION]: The documentation contains specific examples of homoglyph attacks using non-Latin characters to mimic legitimate domains.
Evidence: references/api-reference.md includes the strings gооgle.com and mіcrosoft.com using Cyrillic characters (U+043E and U+0456) to visually imitate Latin characters. While functional for teaching phishing detection, these meet the technical criteria for homoglyph obfuscation.
[EXTERNAL_DOWNLOADS]: The skill fetches data from external cybersecurity monitoring services.
Details: The workflow interacts with crt.sh and certstream.calidog.io. These are recognized, well-known services within the security community for monitoring SSL/TLS certificate issuance.
[COMMAND_EXECUTION]: The skill's documentation provides examples of using third-party command-line utilities for extended analysis.
Details: references/api-reference.md lists example commands for dnstwist and openssl to perform domain permutation analysis and local certificate inspection.

analyzing-certificate-transparency-for-phishing