The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute all reconnaissance traffic from a designated egress host using the pattern ssh -o BatchMode=yes <egress-host> '<cmd>'. This pattern is used for DNS queries, TLS certificate reads, and HTTPS GET requests. If the domain names or discovered subdomains used to populate <cmd> are not sanitized, it could lead to command injection on the egress host.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a significant attack surface for indirect prompt injection through several ingestion points.
Ingestion points: The skill reads targets from a local scope.md file and dynamically discovers subdomains from external Certificate Transparency (CT) logs (crt.sh and Cert Spotter) and GitHub code search results.
Boundary markers: There are no instructions provided to the agent to use delimiters or to ignore potential instructions embedded in the discovered data (e.g., a subdomain named ignore-previous-instructions.example.com).
Capability inventory: The agent is granted the ability to execute shell commands via SSH, perform network requests (HTTPS GET), and query the GitHub API.
Sanitization: The instructions lack any requirement for sanitizing or validating the data retrieved from external logs or search results before using them in command construction or reporting.
[DATA_EXFILTRATION]: The skill includes a dedicated step for 'GitHub code-search OSINT' specifically looking for sensitive strings such as password, api_key, and secret associated with the target domains. While intended for reconnaissance, this automated searching and collection of secrets from public repositories constitutes a data exposure risk.

passive-recon