The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses subprocess.run to call the dnstwist utility for domain permutation analysis, which is a common and appropriate method for identifying lookalike domains.
[EXTERNAL_DOWNLOADS]: The skill retrieves information from well-known and trusted services, including Google Play Store, crt.sh (Certificate Transparency logs), and rdap.org (WHOIS data), to identify potential impersonation attempts.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data from web pages and APIs (e.g., app names from search results). While this presents a theoretical surface for injection if processed by an LLM, the risk is inherent to the skill's monitoring function and it follows standard parsing logic.
Ingestion points: Data is fetched from play.google.com (Step 1 in SKILL.md) and crt.sh (search_certificate_transparency in scripts/agent.py).
Boundary markers: None present.
Capability inventory: The skill utilizes subprocess execution (dnstwist), file writing for reporting, and network operations.
Sanitization: The skill employs BeautifulSoup and json.loads for parsing, but lacks specific sanitization for instruction-like strings in external content.

performing-brand-monitoring-for-impersonation