The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides a specialized Python script, scripts/hpp_agent.py, and instructions for its execution to conduct parameter precedence and WAF bypass testing.
[EXTERNAL_DOWNLOADS]: The skill documentation instructs the user to install the requests library. This is a standard, well-known Python package for HTTP communication from the official package registry.
[PROMPT_INJECTION]: The scripts/hpp_agent.py script retrieves and displays content from remote URLs. This facilitates a surface for indirect prompt injection where a malicious target server could return crafted instructions intended to influence the agent's execution context.
Ingestion points: Response content is read via resp.text in several functions within scripts/hpp_agent.py and printed as part of the tool output.
Boundary markers: The script output does not utilize delimiters or specific warning markers to isolate untrusted external content from the agent's control instructions.
Capability inventory: The skill is capable of performing GET and POST network requests to arbitrary URLs provided by the user.
Sanitization: While the script truncates response bodies to 2000 characters, it does not perform any escaping, validation, or sanitization of the remote content before presenting it to the agent.

hpp-hunter