The Agent Skills Directory

[SAFE]: The skill's primary function is to detect domain fronting by comparing SNI and Host headers in network logs. The use of network sockets to retrieve TLS certificates for verification is an expected behavior for this type of security tool.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted proxy log data which is subsequently included in a generated report. While this presents an attack surface for indirect prompt injection, the risk is considered low and associated with the tool's intended purpose.
Ingestion points: scripts/agent.py reads CSV logs using csv.DictReader from a user-supplied file path.
Boundary markers: None identified in the script or documentation.
Capability inventory: Performs network connections via socket.connect and writes to a JSON file using json.dump.
Sanitization: Data is stripped and converted to lowercase but not otherwise sanitized against malicious instructions embedded in log fields.

hunting-for-domain-fronting-c2-traffic