The Agent Skills Directory

[SAFE]: The skill's offensive content, including RCE payloads and exploitation techniques, is consistent with its stated purpose as a security hunting tool for bug bounty engagements.
[SAFE]: Implements a mandatory confirmation gate requiring users to provide target details, confirm authorization, and review exact commands before any action is taken.
[COMMAND_EXECUTION]: Provides instructional templates for using tools such as curl, kubectl, and java to interact with target systems during authorized security assessments.
[EXTERNAL_DOWNLOADS]: Documents procedures for downloading diagnostic assets, such as jenkins-cli.jar from a target server or exploit.jar for testing deserialization gadgets in isolated environments.
[INDIRECT_PROMPT_INJECTION]: The skill analyzes untrusted external data including HTTP headers, response bodies, and JavaScript source code.
Ingestion points: Target response headers, HTML/JSON bodies, and frontend JavaScript bundles (SKILL.md).
Boundary markers: Strong instructional safety gate requiring target URL, IP, and scope confirmation before execution (SKILL.md).
Capability inventory: Uses curl for network requests, kubectl for Kubernetes API interaction, and java for CLI tool execution (SKILL.md).
Sanitization: Relies on human-in-the-loop verification and explicit command review instead of automated sanitization.

hunt-rce