The Agent Skills Directory

[SAFE]: The skill functions as a security testing guide, following established frameworks like the OWASP Web Security Testing Guide (WSTG). The methodologies and tool usage described (e.g., banner grabbing, cookie analysis, and banner scanning) are standard practices for security researchers.
[REMOTE_CODE_EXECUTION]: The automated detection of a command piping remote content to Python is a false positive. The payload curl -s http://TARGET/static/app.js.map | python3 -m json.tool uses the -m json.tool module, which is a standard library utility for pretty-printing and validating JSON data. This does not involve executing the input stream as Python code.
[INDIRECT_PROMPT_INJECTION]: The skill's primary function involves ingesting data from untrusted external web targets (e.g., server headers, robots.txt, and source maps). This creates a theoretical surface for indirect prompt injection; however, the risk is inherent to the skill's purpose of reconnaissance. The usage of specific command-line filters like grep and the json.tool parser mitigates the risk of direct instruction execution by the agent.

web-fingerprinting