The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the installation of the nosqlmap package using pip3 install nosqlmap. This downloads and installs code from an external repository (PyPI) that is not part of the skill's distributed files.
[COMMAND_EXECUTION]: The skill executes several shell-based tasks:
Multiple curl commands to perform POST requests with JSON payloads against a user-defined $TARGET.
A shell for loop (Phase 4) that executes curl and wc -c to perform character enumeration and data dumping.
Execution of the nosqlmap CLI tool once installed.
[INDIRECT_PROMPT_INJECTION]: The skill represents a surface for indirect prompt injection because it ingests data from external, untrusted network targets.
Ingestion points: Data enters the agent context through curl responses and the output of the nosqlmap tool (SKILL.md, Phases 1-6).
Boundary markers: There are no explicit boundary markers or instructions to treat response data from the $TARGET as untrusted text.
Capability inventory: The skill has the capability to execute shell commands (curl, nosqlmap), perform network operations, and write to the console.
Sanitization: There is no evidence of sanitization or validation performed on the data received from external targets before it is processed or displayed.

hunt-nosqli