The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted data from external sources, such as web input fields, URL parameters, and headers, to identify vulnerabilities. This represents an attack surface for indirect prompt injection.
Ingestion points: SKILL.md identifies target fields like bio, name, description, email templates, invoice names, and URL path parameters as sources of external data.
Boundary markers: The skill implements a 'Mandatory confirmation gate' that requires the agent to ask the user for the target, confirm authorization, and show the exact command before proceeding.
Capability inventory: The skill contains instructions for the agent to use tools for probing and command execution (e.g., executing shell commands via os.popen, exec, or backticks).
Sanitization: No explicit technical sanitization is defined for the inputs; safety relies on the human-in-the-loop confirmation gate and the agent's adherence to the provided safety guidelines.
[COMMAND_EXECUTION]: The skill documentation includes specific Remote Code Execution (RCE) payloads for various template engines intended for security assessment purposes.
Evidence: Provides payloads such as {{config.__class__.__init__.__globals__['os'].popen('id').read()}} (Jinja2), {{_self.env.registerUndefinedFilterCallback("exec")}} (Twig), and <%= id %> (ERB).
Context: These are provided as reference material for authorized security testing and are subject to the mandatory confirmation gate mentioned above.

hunt-ssti