The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill prompts the execution of unverified code through npx darknet-mcp-server and git clone https://github.com/badchars/darknet-mcp-server.git. These sources do not belong to the primary vendor or known trusted organizations.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from the dark web (via Tor) and threat intelligence feeds. This content is inherently adversarial and lacks documented sanitization, presenting a vulnerability surface for indirect prompt injection.\n
Ingestion points: SKILL.md describes tools like tor_fetch_onion, tor_scrape_onion, and breachSearch that ingest data from the web.\n
Boundary markers: No boundary markers or instructions to ignore embedded commands are specified for handling external data.\n
Capability inventory: The skill can perform network operations and upload local files via the hybrid_submit tool.\n
Sanitization: There is no evidence of sanitization or input validation for data retrieved from external sources before it is processed by the agent.\n- [DATA_EXFILTRATION]: The hybrid_submit tool allows for the uploading of local files to a third-party analysis service. This capability could be abused to exfiltrate sensitive local data if the agent is manipulated by malicious input.\n- [COMMAND_EXECUTION]: The installation guide includes shell commands for setting up a Tor proxy and running the server, which involve local system modifications and the execution of external scripts.

darknet-mcp-server-threat-intelligence