The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides numerous shell commands and a bash script for automating security reconnaissance. These commands execute external binaries like Amass, Subfinder, and Nuclei to probe targets.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external sources including target domain outputs, HTTP response headers, and historical URL archives from the Wayback Machine. This data is ingested into the agent context and piped into various tools and shell loops. The skill includes manual confirmation gates as boundary markers, but lacks explicit programmatic sanitization or escaping when interpolating external data into shell commands, such as in the automated XSS hunting pipeline which uses a while read url loop to execute curl on retrieved strings.
[EXTERNAL_DOWNLOADS]: The workflow relies on and encourages the installation of numerous third-party security tools from various GitHub repositories and package registries. While these are common industry tools, they represent an external dependency chain that requires monitoring for supply chain risks.

red-team-tools