The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion and analysis of external, untrusted content from a user-specified $TARGET host using commands like curl -s "https://$TARGET/". The absence of strict boundary markers or sanitization when processing this external HTML and JavaScript content could allow a malicious target to influence the agent's behavior via injected instructions.
Ingestion points: Phase 1 (curl -s "https://$TARGET/"), Phase 2 (onmessage handler analysis), Phase 3 (Service Worker script retrieval), Phase 5 (minified JS chunk analysis).
Boundary markers: The instructions do not specify the use of delimiters or clear warnings for the agent to ignore instructions embedded within the fetched target source code.
Capability inventory: The skill utilizes shell command execution (Bash blocks) and network utilities (curl).
Sanitization: No sanitization, escaping, or filtering of the retrieved web content is performed before the agent processes it.
[DATA_EXFILTRATION]: The skill utilizes network operations (curl) to interact with external domains for vulnerability research. It also instructs the agent to generate payloads designed to exfiltrate sensitive browser data (such as cookies, tokens, and authorization headers) to researcher-controlled Out-of-Band (OOB) hosts like https://OOB.example or https://evil.com. While these patterns are part of the skill's documented security auditing purpose, they involve the transmission of data to non-whitelisted external destinations.

hunt-dom