The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill contains numerous instructions to install tools from unverified third-party GitHub repositories (e.g., github.com/assetnote/kiterunner, github.com/LukaSikic/subzy, github.com/KathanP19/HowToHunt). These sources are not recognized as trusted organizations or well-known services and represent unpinned dependencies.
[DATA_EXFILTRATION]: The skill references the domain book.hacktricks.xyz, which has been explicitly flagged as malicious by automated scanners (URLite: EshopScam).
[INDIRECT_PROMPT_INJECTION]:
Ingestion points: Reconnaissance tools (subfinder, katana) and collectors (waybackurls, gau) process untrusted data from external targets, which is then ingested into the agent context.
Boundary markers: The skill lacks delimiters or explicit instructions to ignore embedded commands within the external data being processed.
Capability inventory: Extensive access to shell execution, package managers (pip, go, brew), and network utilities (curl, wget) across all scripts.
Sanitization: There is no evidence of validation or sanitization for the external content before it is processed or interpolated into commands.
[COMMAND_EXECUTION]: The skill generates and executes complex shell pipelines and scripts for reconnaissance and vulnerability validation, which could be exploited if target inputs are not properly handled.
[PROMPT_INJECTION]: The skill's frontmatter contains non-English trigger words, and the body includes strong behavioral directives intended to override agent logic (e.g., "THE ONLY QUESTION THAT MATTERS... STOP. Do not write.").

bug-bounty