The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill provides instructions to fetch OpenID Connect (OIDC) configuration files from target domains using curl to identify attack surfaces and endpoint configurations.
[COMMAND_EXECUTION]: Multiple example commands are provided for reconnaissance and testing, including grep for pattern matching in source code, adb for testing mobile deep links, and curl for interacting with OAuth endpoints. These are standard tools for security auditing.
[REMOTE_CODE_EXECUTION]: A pattern involving curl piped to python3 was detected by automated scans. Manual analysis confirms this is a benign usage of the standard library module json.tool (python3 -m json.tool) used specifically for pretty-printing JSON responses from discovery endpoints, not for executing arbitrary code.
[INDIRECT_PROMPT_INJECTION]: The hunting methodology involves processing external, untrusted data such as mobile application packages (APKs) and web server responses. While this presents a potential surface for indirect prompt injection if the agent parses malicious content without boundaries, it is a necessary component of the skill's purpose as a security research tool.

hunt-oauth