The Agent Skills Directory

[COMMAND_EXECUTION]: The skill includes numerous templates for using curl and grep to interact with web endpoints and analyze application responses for security vulnerabilities.
Evidence: Templates cover actions such as probing for internal paths, testing rate limits, and attempting payment flow manipulation on designated test targets.
[EXTERNAL_DOWNLOADS]: The instructions direct the agent to fetch remote content, including robots.txt, sitemap.xml, and JavaScript bundles, from external servers for surface area mapping.
Evidence: Commands such as curl -s https://target.example/robots.txt are used to retrieve configuration files from external domains.
[INDIRECT_PROMPT_INJECTION]: The skill possesses an indirect prompt injection attack surface as it is designed to ingest and process data from external target websites which could contain adversarial instructions.
Ingestion points: Remote content from target domains is fetched via curl and passed into the agent's context for analysis.
Boundary markers: The skill implements a strong mandatory confirmation gate requiring the agent to ask for target details, verify authorization, and show exact commands to the user before proceeding.
Capability inventory: The skill utilizes diagnostic tools (curl, grep) for information gathering; it does not include capabilities for file modification, persistent access, or privilege escalation.
Sanitization: No specific filtering or sanitization of the retrieved HTTP response content is defined within the provided methodology.

hunt-business-logic