The Agent Skills Directory

[SAFE]: The skill performs legitimate passive reconnaissance activities. No malicious patterns such as prompt injection, data exfiltration of sensitive local files, or obfuscation were detected. All network operations are directed towards well-known OSINT data sources (e.g., crt.sh, Google DNS, authoritative WHOIS servers) and the target domain itself for SSL inspection. The script relies solely on Python's standard library, minimizing supply chain risks.
[INDIRECT_PROMPT_INJECTION]: The skill processes data from external third-party sources (crt.sh, Google DoH, and WHOIS servers). While this is the primary purpose of the skill, it introduces a surface where malicious external content could attempt to influence the agent. However, as a passive OSINT tool, this is an inherent and expected risk of the domain, and the skill does not possess dangerous execution capabilities (like eval) to be directly exploited.
Ingestion points: Network fetches from crt.sh and dns.google in scripts/domain_intel.py.
Boundary markers: None; results are returned as structured JSON for agent interpretation.
Capability inventory: Standard network sockets and HTTP requests; no file writing or code execution.
Sanitization: Standard JSON and regex parsing of external data.

domain-intel