The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill provides instructions to download the SecLists wordlist collection from its official GitHub repository. It also lists installation commands for the ffuf tool using standard package managers such as Homebrew and Go.
[DYNAMIC_CONTEXT_INJECTION]: The SKILL.md file uses shell command execution at load time to verify the environment and tool availability.
Evidence: !command -v ffuf > /dev/null 2>&1 && echo "YES -- $(ffuf -V 2>&1 | head -1)" || echo "NO -- Install: brew install ffuf (macOS) | go install github.com/ffuf/ffuf/v2@latest"
Evidence: !test -f scripts/ffuf/fuzz-parameters.sh && echo "YES -- use wrapper scripts for structured JSON output" || echo "NO -- using standalone mode with direct commands"
[INDIRECT_PROMPT_INJECTION]: The skill facilitates fuzzing of external web targets, which involves the agent reading and processing HTTP responses that could contain malicious instructions.
Ingestion points: Target URL response bodies, headers, and status codes processed by the agent as described in SKILL.md.
Boundary markers: The skill mentions that commands are validated against .pentest/scope.json, providing a mechanism for target restriction.
Capability inventory: Shell command execution via bash and ffuf in SKILL.md.
Sanitization: No explicit sanitization or filtering is mentioned for the content retrieved from the fuzzing targets.
[COMMAND_EXECUTION]: The skill executes the ffuf binary and local bash scripts, such as scripts/ffuf/fuzz-parameters.sh and scripts/ffuf/examples.sh, to perform security testing tasks.

ffuf