The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes various shell commands (e.g., curl, grep, git, xxd) to perform reconnaissance, check for exposed directories like .git/, and search for hardcoded secrets within web bundles.
[EXTERNAL_DOWNLOADS]: The skill installs several standard security auditing tools using package managers, including pip3 install git-dumper, pip3 install ds_store, and npm install for source-map-explorer and unwebpack-sourcemap. These tools are fetched from official public registries (PyPI and NPM).
[DYNAMIC_EXECUTION]: The skill employs python3 -c to execute inline Python scripts. These scripts are defined within the skill and are used to parse JSON data (such as Swagger/OpenAPI specifications or JavaScript source maps) and to reconstruct source code directories in /tmp/sourcemap_extract/.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted data from remote target systems (e.g., .js.map files, swagger.json, and Git logs). This ingestion of external content constitutes a theoretical attack surface for indirect prompt injection or tool output poisoning.
Ingestion points: Multiple curl operations targeting https://$TARGET/ in SKILL.md retrieve external artifacts.
Boundary markers: None are present to distinguish between target data and agent instructions.
Capability inventory: The skill possesses capabilities for file system writing, command execution, and network access.
Sanitization: The source map extraction script in SKILL.md includes basic path sanitization using .replace() to mitigate directory traversal attempts during file reconstruction.

hunt-source-leak