The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill uses the curl utility to fetch HTTP headers and HTML source code from remote web targets (e.g., target.com) to evaluate security policy configurations.
[COMMAND_EXECUTION]: Shell commands such as curl and grep are utilized to programmatically inspect and parse the Content Security Policy of target web applications.
[DATA_EXFILTRATION]: The instructions include template payloads for exfiltrating sensitive information, such as cookies, to an external domain (attacker.com). These are intended as proof-of-concept examples for security researchers to verify CSP effectiveness.
[PROMPT_INJECTION]: The skill creates an indirect prompt injection surface by ingesting and processing untrusted content from external URLs during the reconnaissance phase.
Ingestion points: Remote content is retrieved via curl commands in Step 1 of the workflow.
Boundary markers: The skill does not implement delimiters or explicit instructions to ignore embedded commands within the fetched external data.
Capability inventory: The skill is equipped with network retrieval capabilities via curl and text parsing via grep.
Sanitization: No sanitization or validation is applied to the content retrieved from remote web services before analysis.

performing-content-security-policy-bypass