The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill provides direct links to multiple credential search and breach database services, including Dehashed, Snusbase, LeakCheck, BreachDirectory, and LeakPeek. These platforms facilitate the retrieval of sensitive clear-text passwords and personal information from compromised datasets.
[OBFUSCATION]: Automated reputation scanners have flagged the included domain 'socketscan.io' as associated with phishing activity. The inclusion of malicious or high-risk domains within a recommended resource list poses a direct threat to users who navigate to these sites.
[INDIRECT_PROMPT_INJECTION]:
Ingestion points: The methodology defines tasks for analyzing large external datasets, document dumps, and web-scraped content using AI agents (e.g., via the 200K/2M token context windows of Claude and Gemini).
Boundary markers: The skill fails to provide any instructions for using delimiters or boundary markers to differentiate between user-provided instructions and the potentially malicious instructions embedded within the OSINT data being analyzed.
Capability inventory: The described methodology integrates with high-impact capabilities including network reconnaissance tools (Shodan, Censys), browser automation (Playwright), and workflow automation platforms (n8n).
Sanitization: No procedures are specified for sanitizing, filtering, or validating external content before it is processed by the AI, leaving the agent vulnerable to instructions contained within the ingested artifacts.
[DATA_EXFILTRATION]: The skill's focus on breach data and the use of tools like 'theHarvester' and 'Recon-ng' for harvesting emails and metadata creates a high risk of sensitive data exposure if used against unauthorized targets.

offensive-osint