The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill provides instructions for acquiring security tools from external sources, including the official Microsoft GitHub repository for the RESTler fuzzer. These downloads are directed at trusted organizations and are necessary for the skill's intended use case of API fuzzing and auditing.
[EXTERNAL_DOWNLOADS]: The skill references documentation from HackTricks, a well-known and widely used security research platform. While automated scanners may flag such resources due to the inclusion of security-related payloads, the site is a standard reference in the cybersecurity industry.
[COMMAND_EXECUTION]: The instructions contain numerous command-line examples using standard utilities such as curl, ffuf, gobuster, and wfuzz. These commands are designed to perform network reconnaissance, authentication testing, and fuzzing against target API endpoints as part of a security engagement.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze potentially untrusted data from external sources during the discovery phase.
Ingestion points: Network responses from target APIs (JSON/XML/GraphQL), JavaScript source files (app.js), and API documentation files (Swagger/OpenAPI specifications).
Boundary markers: The skill does not define specific delimiters for separating ingested data from instructions.
Capability inventory: The skill uses curl for network operations and shell commands for file processing and fuzzing.
Sanitization: The skill assumes the user will manually review outputs from the recommended tools; no automated sanitization of ingested content is explicitly provided within the command examples.

testing-apis