The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides instructions for running numerous external security tools including gau, waybackurls, katana, nuclei, and dalfox to crawl and scan target domains for redirect parameters.
[DATA_EXFILTRATION]: The core methodology details how to steal OAuth authorization codes and access tokens by redirecting them to attacker-controlled infrastructure such as ngrok or external listeners.
[EXTERNAL_DOWNLOADS]: The skill documentation recommends installing various third-party packages and tools (requests, colorama, flask, openredirex) and includes references to an external script (https://analytics.third-party.com/track.js) flagged as malicious by automated scanners.
[REMOTE_CODE_EXECUTION]: The provided Python script scripts/redirect_probe.py performs automated HTTP requests and header manipulation, and the guide references/oauth-redirect-guide.md was flagged by antivirus software for containing suspicious script content.
[CREDENTIALS_UNSAFE]: The OAuth guide and fuzzing script handle sensitive data such as authorization codes, access tokens, and client_secret values, which are captured or transmitted during exploitation.
[PROMPT_INJECTION]: The skill provides payloads utilizing homoglyphs and zero-width characters to bypass security filters, and creates a surface for indirect prompt injection by ingesting and processing content from external web targets without sanitization.

redirect-forge