The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill defines procedures for ingesting and processing data from external servers (LDAP/XPath targets) using curl and python3. This creates a surface where untrusted data could theoretically influence the agent's context, although the logic provided is restricted to boolean size comparison and JSON parsing.
Ingestion points: Server responses from $TARGET in Phases 1, 2, 3, 4, and 5 (SKILL.md).
Boundary markers: Not explicitly defined for server responses in the provided bash scripts.
Capability inventory: curl (network request), python3 (data parsing/formatting), and ldapsearch are used across all methodology phases to interact with external targets.
Sanitization: Uses python3's json.load() for parsing results in Phase 5, which provides structural validation of the incoming data.
[COMMAND_EXECUTION]: The skill provides bash scripts that use curl, python3, and ldapsearch to perform security testing. These are legitimate tools for the skill's stated purpose of hunting LDAP and XPath injections. No malicious or hidden command execution patterns were identified.

hunt-ldap