The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill facilitates the download and execution of an external PHP exploit script from an untrusted GitHub repository (ambionics/laravel-ignition-rce). This introduces a risk where compromised or malicious repositories could execute code on the user's system.
[EXTERNAL_DOWNLOADS]: The skill uses git clone to fetch external tooling at runtime and executes it via the PHP interpreter. These resources do not originate from trusted vendors or organizations.
[COMMAND_EXECUTION]: The instructions include multiple instances of piping data from a remote target ($TARGET) directly into a local Python interpreter using python3 -m json.tool. Piping untrusted remote content into a local interpreter is a dangerous pattern that could lead to code execution if the target returns specially crafted malicious data.
[INDIRECT_PROMPT_INJECTION]: The skill ingests data from external targets via Telescope and Horizon API endpoints (e.g., /telescope/api/requests) without sanitization or boundary markers. This creates an attack surface where a malicious target could inject instructions into the agent's context. The skill possesses high-privilege capabilities including network operations and local file execution, which increases the impact of such an injection.

hunt-laravel