The Agent Skills Directory

[COMMAND_EXECUTION]: The automated scripts scripts/agent.py and scripts/process.py invoke external CLI tools (subfinder, httpx, dnsx, dig) using subprocess.run. The implementation correctly uses list-based arguments, which prevents shell injection vulnerabilities.
[EXTERNAL_DOWNLOADS]: Instructions in SKILL.md direct the user to install subfinder from ProjectDiscovery's GitHub repository. This is a well-known and trusted source for security research tools.
[INDIRECT_PROMPT_INJECTION]: The skill collects untrusted data from the internet, including subdomain names and HTTP response metadata (titles and technology signatures). This content is written to Markdown and JSON reports which may be consumed by an LLM.
Ingestion points: Data is ingested from subfinder and httpx tool outputs in scripts/agent.py and scripts/process.py.
Boundary markers: None identified; untrusted data is placed directly into output reports.
Capability inventory: Commands are executed via subprocess.run in scripts/agent.py and scripts/process.py.
Sanitization: There is no evidence of sanitization or escaping of the web-sourced metadata before inclusion in the final reports.

performing-subdomain-enumeration-with-subfinder