The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data, including JSON output from testssl.sh and certificate data from the crt.sh API. Ingestion points occur in SKILL.md when the agent is instructed to parse tool results. No explicit boundary markers or input sanitization are present in the provided scripts. Capabilities available include network access via curl and requests, and shell execution for tools like openssl, nmap, and tlsx.
[EXTERNAL_DOWNLOADS]: The instructions recommend installing the certstream Python package for monitoring Certificate Transparency logs. This is a standard library used in security reconnaissance.
[DYNAMIC_EXECUTION]: The skill provides Frida scripts for runtime instrumentation to bypass mobile certificate pinning. This dynamic code injection is a standard procedure for mobile security auditing as described in the skill's purpose.

offensive-tls-attacks