The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts/agent.py script and accompanying instructions in SKILL.md rely on subprocess.run to operate external security binaries (subfinder, amass, httpx, and nuclei). The implementation correctly uses list-based arguments rather than shell strings, which provides protection against command injection while enabling the agent to perform complex reconnaissance and scanning tasks. \n- [EXTERNAL_DOWNLOADS]: The skill's setup instructions guide the user to download and install security tools from the official ProjectDiscovery GitHub repositories via go install. These are well-known, industry-standard tools for attack surface discovery hosted on a recognized platform. \n- [INDIRECT_PROMPT_INJECTION]: The skill processes data from various external sources, establishing a potential attack surface for indirect prompt injection. \n
Ingestion points: Data is ingested from the Shodan and Censys APIs, as well as the output files from httpx and nuclei scans in scripts/agent.py. \n
Boundary markers: The processing logic does not employ specific delimiters or instructions to ignore embedded commands within the ingested reconnaissance data. \n
Capability inventory: The script possesses capabilities to execute external binaries via subprocess.run and to write JSON reports to the local filesystem. \n
Sanitization: The script processes and deduplicates results without explicit sanitization of potentially untrusted strings returned from external service banners or vulnerability findings.

implementing-attack-surface-management