The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides numerous bash command templates for the ffuf (Fuzz Faster U Fool) utility. These are intended for offensive security testing such as directory discovery, subdomain enumeration, and parameter fuzzing.
[EXTERNAL_DOWNLOADS]: Refers users to official sources for tool installation, including github.com/ffuf/ffuf (the tool's official repository) and Homebrew. These are well-known, trusted sources for security professionals.
[CREDENTIALS_UNSAFE]: The documentation provides an example of a raw HTTP request file (req.txt) containing a placeholder JWT token. This is used for illustrative purposes to demonstrate authenticated fuzzing. The skill explicitly warns users to manage real credentials securely using local editors and proper file permissions (0600).
[INDIRECT_PROMPT_INJECTION]: The skill acknowledges that fuzzing results (HTML reports or output strings) may contain hostile data from target systems. It instructs the agent to treat this output as inert data and warns against potential injection risks from untrusted target responses.
[SAFEGUARD_MECHANISMS]: Implements a 'Mandatory confirmation gate' requiring the agent to verify the target URL, written authorization, and scope with the user before executing any commands. It also includes an explicit 'risk: offensive' metadata tag.

ffuf-web-fuzzing