The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the agent to install numerous third-party tools via pip3 (arjun, xsstrike, sqlmap), go (kiterunner, subzy), and brew (trufflehog, gitleaks). These originate from external, non-vendor repositories.
[REMOTE_CODE_EXECUTION]: Instructions include a curl command to download and save a SKILL.md file directly from a remote GitHub repository to the local agent skills directory.
[COMMAND_EXECUTION]: The toolkit relies extensively on shell commands for performing active reconnaissance, such as subdomain enumeration and fuzzing with tools like ffuf, nuclei, and dalfox.
[DATA_EXFILTRATION]: The skill uses curl to interact with the HackerOne GraphQL API (hackerone.com/graphql) for program scope retrieval. While a standard platform for bug bounty, it represents automated external network interaction.
[PROMPT_INJECTION]: The skill body contains strong imperative methodology rules and examples of prompt injection techniques (e.g., 'ignore previous instructions' in descriptions of AI vulnerabilities) which may trigger safety filters or influence agent behavior.
[PROMPT_INJECTION]: The skill processes untrusted data from the web (crawled URLs, GitHub repos) using various tools (katana, subfinder) without explicit sanitization or boundary markers, creating a surface for indirect prompt injection. Ingestion points include KATANA and SUBFINDER; capabilities include full shell access and tool execution; no specific sanitization or delimiters are provided.
[REMOTE_CODE_EXECUTION]: The automated scanner flagged a connectivity check to hackerone.com/graphql as potential remote code execution; however, the command (curl ... -o /dev/null) is a benign connectivity test using the HTTP status code.

bb-local-toolkit