The Agent Skills Directory

[COMMAND_EXECUTION]: Employs curl to perform network-based vulnerability probing, such as checking for debug endpoints and static asset exposures on remote targets.
[INDIRECT_PROMPT_INJECTION]: Processes external content from target servers (HTML, JSON), creating a potential surface for indirect prompt injection if the remote data contains adversarial instructions.
Ingestion points: Multiple curl commands fetching data from $TARGET (e.g., in fingerprinting and data leakage phases).
Capability inventory: Shell execution for curl, grep, and python3 commands.
Boundary markers: No specific delimiters or safety warnings are applied to the output of these commands.
Sanitization: External data is processed directly via regex and JSON parsers without prior sanitization.
[DYNAMIC_EXECUTION]: Uses python3 -c to execute static, hardcoded Python snippets that parse build IDs and environment variables from the target's response data.
[DATA_EXFILTRATION]: Outlines techniques for identifying data leakage, such as RSC payload exposure and unauthorized Server Action calls, which is the intended functional purpose of the tool.

hunt-nextjs