The Agent Skills Directory

[SAFE]: The skill is entirely documentation-based and does not bundle any executable scripts, binary files, or hidden payloads. The metadata explicitly notes that helper scripts and commands are not bundled.
[SAFE]: Employs a robust safety framework, including a "Mandatory confirmation gate" and "Verification boundaries," which requires the agent to wait for explicit user confirmation of scope and authorization before executing any commands.
[INDIRECT_PROMPT_INJECTION]: The skill defines workflows for processing external information (e.g., CNAME records, HTTP response headers, and target subdomain lists) which could be used as an injection vector.
Ingestion points: Data is read from external reconnaissance files like subdomains.txt and live network responses.
Boundary markers: Strong instructional constraints are provided in the "Mandatory confirmation gate" to prevent autonomous probing or exploitation.
Capability inventory: The methodology utilizes common security tools such as subfinder, nuclei, subjack, curl, and dig.
Sanitization: The process emphasizes manual "Verification boundaries" and "Gate 0 Validation" steps performed by the operator.
[EXTERNAL_DOWNLOADS]: Refers to external third-party tools and template repositories such as nuclei-templates and subjack fingerprints. These are industry-standard security resources, and the skill provides instructions for their manual use rather than automating their retrieval through dangerous execution patterns.

hunt-subdomain