The Agent Skills Directory

[SAFE]: The skill is a collection of reconnaissance and security testing commands targeting FastAPI applications.
[COMMAND_EXECUTION]: The skill utilizes common utilities like curl, jq, ffuf, and wscat. The commands are structured for security enumeration (fingerprinting, schema mining, and vulnerability verification) and do not contain shell injection vulnerabilities or unauthorized privilege escalation attempts.
[DATA_EXFILTRATION]: No evidence of unauthorized data transmission was found. Network requests are directed at the user-defined target application. The use of 'evil.com' in Host and Origin headers is a standard methodology for testing CORS and host header injection vulnerabilities and does not represent an exfiltration vector.
[PROMPT_INJECTION]: The skill ingests external data (OpenAPI schemas) during the enumeration phase.
Ingestion points: SKILL.md (Phase 1 — OpenAPI Schema Mining).
Boundary markers: Absent.
Capability inventory: Subprocess execution of curl, ffuf, wscat, and jq across all phases.
Sanitization: Absent. This represents an indirect prompt injection surface; however, the impact is negligible as the ingested data is used for manual endpoint discovery rather than automated decision-making or sensitive logic execution.

hunt-fastapi