The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill establishes a workflow that ingests untrusted data from target web applications, creating a surface for indirect prompt injection attacks.
Ingestion points: Target application responses and error messages captured via curl and sqlmap (SKILL.md).
Boundary markers: Absent; the skill does not define specific delimiters for separating target data from agent instructions.
Capability inventory: Execution of shell commands and security tools such as sqlmap (SKILL.md).
Sanitization: Absent; there is no instruction to escape or validate the content returned from target systems before processing.
[EXTERNAL_DOWNLOADS]: The skill references several external resources for vulnerability research and payload identification from well-known platforms.
Evidence: References to HackerOne reports, SonarSource research, and GitHub advisories provide historical context and evidence for SQL injection hunting.
[COMMAND_EXECUTION]: The skill provides numerous templates for shell commands and the use of the sqlmap utility to probe external systems.
Evidence: Commands like sqlmap -u "..." --dbs and curl -o /dev/null ... are used throughout the hunting methodology to interact with target infrastructure.

hunt-sqli