The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes several shell commands and external utilities to perform security testing.
Executes curl with reflected Origin headers and user-supplied $SESSION_COOKIE to probe API endpoints.
Utilizes httpx for bulk discovery of CORS headers across target lists.
Recommends the use of nuclei with specific CORS misconfiguration templates for automated scanning.
[EXTERNAL_DOWNLOADS]: Recommends the installation of a specialized security tool via pip3 install corsy. While corsy is a known tool in the security community, it is an external dependency from a non-standard vendor.
[INDIRECT_PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection through its data ingestion patterns.
Ingestion points: Reads target data from recon/$TARGET/api-endpoints.txt and recon/$TARGET/live-hosts.txt (SKILL.md).
Boundary markers: None identified; the skill directly processes lines from these files into shell commands.
Capability inventory: Perform network requests via curl, httpx, and nuclei; executes Python scripts (corsy); reads local files.
Sanitization: No explicit sanitization or validation of the input file content is performed before passing it to command-line arguments.

hunt-cors