The Agent Skills Directory

[COMMAND_EXECUTION]: The skill includes curl command examples for testing how web applications handle HTML payloads (e.g., curl "http://target.com/search?q=<h1>Test</h1>"). These are standard security testing practices and do not involve malicious exfiltration or unauthorized access.
[REMOTE_CODE_EXECUTION]: The skill provides a Python fuzzing script template that uses the requests library to automate the testing of HTML payloads against a target URL. This script is contained within the skill's instructions as a reference for the user and does not execute untrusted remote code.
[DATA_EXFILTRATION]: While the skill demonstrates how an attacker might use HTML injection to create phishing forms that send data to an attacker.com domain, these are provided as conceptual examples of vulnerabilities for testing purposes, not as active exfiltration mechanisms within the skill itself.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to process user-provided URLs and parameters for vulnerability testing. It provides remediation guidance, such as using htmlspecialchars in PHP or DOMPurify in JavaScript, to mitigate these risks in applications.

HTML Injection Testing