The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides bash commands utilizing standard utilities such as curl, awk, and grep, as well as security tools like httpx and nuclei. These are used to probe user-defined targets for CORS misconfigurations. The risk of unintended execution is mitigated by a mandatory confirmation gate that requires the agent to verify the target URL, IP, and written authorization scope with the user before any active probing occurs.
[INDIRECT_PROMPT_INJECTION]: The skill processes external data including target identifiers and lists of API endpoints provided in local reconnaissance files. This constitutes a potential attack surface for indirect prompt injection. However, the skill incorporates robust mitigations to handle untrusted data.
Ingestion points: User-supplied $TARGET variable and local recon files such as recon/$TARGET/api-endpoints.txt and recon/$TARGET/live-hosts.txt.
Boundary markers: A mandatory confirmation gate is explicitly defined, requiring the agent to display the exact command and explain its effect before execution.
Capability inventory: The skill possesses network communication capabilities (curl, httpx, nuclei) and file system read access (cat, grep, awk).
Sanitization: The instructions explicitly mandate validating all bulk inputs against an authorized scope allowlist prior to processing.

hunt-cors