The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill contains instructions to pipe content from target domains to python3. Analysis confirms this is used solely for JSON pretty-printing via the json.tool module (e.g., curl ... | python3 -m json.tool). This is a standard practice for formatting minified source maps and does not execute arbitrary code from the remote source.
[EXTERNAL_DOWNLOADS]: The documentation provides installation commands for several well-known security tools from trusted sources including GitHub, NPM, and PyPI. Examples include katana, trufflehog, jsluice, and LinkFinder. These downloads are intended to set up a penetration testing environment.
[COMMAND_EXECUTION]: The skill primarily consists of a library of shell commands for security analysis. These commands use standard Linux utilities and established security tools to perform reconnaissance, find endpoints, and trace vulnerability flows.
[CREDENTIALS_UNSAFE]: The skill includes a detailed list of regex patterns in references/patterns.md designed to identify hardcoded secrets in target files. These patterns (e.g., searching for Stripe or AWS keys) are intended for grep-based discovery and do not contain actual hardcoded credentials belonging to the skill author or vendor.
[DYNAMIC_EXECUTION]: Multiple sections utilize `python3
<< 'EOF'` to execute local utility scripts for tasks like recursive JS discovery or entropy calculation. These scripts are statically defined within the skill and do not ingest untrusted input for code generation.

js-analyzer