The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides bash commands using curl to perform various HTTP requests against a user-defined target. These commands are used to test for authorization bypasses by manipulating HTTP methods, headers, and path structures.
[EXTERNAL_DOWNLOADS]: The skill references third-party security tools hosted on GitHub, such as lobuhi/byp4xx, maurosoria/dirsearch, and epi052/feroxbuster. These references are informative and point to well-known community tools used in penetration testing; the skill does not include instructions for automated installation or execution of these remote scripts.
[INDIRECT_PROMPT_INJECTION]: The skill captures and analyzes data from remote HTTP responses (headers and bodies), which is a source of untrusted data entering the agent's context.
Ingestion points: HTTP response headers and bodies captured via curl and saved to the $OUTDIR directory (SKILL.md).
Boundary markers: None identified; the skill compares raw output against a baseline.
Capability inventory: The skill uses curl for network requests and mkdir for filesystem organization. It does not perform dynamic code execution (eval/exec) on the captured data.
Sanitization: The skill involves direct inspection of raw response data for comparison purposes, with no automated filtering or sanitization of the remote content.

401-403-bypass-techniques