The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses unsanitized variables such as $TARGET, $js, and $sm directly within shell commands (e.g., curl ... "https://$TARGET$js"). This creates a significant command injection surface where a malicious target name or file path could lead to arbitrary command execution on the agent's underlying system.
[REMOTE_CODE_EXECUTION]: Automated scanners identified patterns where content from untrusted remote targets is piped directly into the python3 interpreter. Although currently used with the json.tool module or specific inline scripts, the architecture of piping unvalidated remote data to an interpreter is a high-risk pattern that can be easily subverted.
[DATA_EXFILTRATION]: The skill explicitly automates the retrieval of sensitive configuration files, including .env and GCP service-account.json files, from remote targets. While intended for red-teaming, this automated credential and configuration harvesting is a core pattern in malicious data exfiltration workflows.
[PROMPT_INJECTION]: The skill fetches and processes remote content (HTML, JS, and JSON) and presents it to the agent without sanitization or protective boundary markers. Ingestion points: Phase 1 and 3 curl operations. Boundary markers: Absent. Capability inventory: shell access, python3 execution, and gcloud CLI. Sanitization: Absent. This enables a surface for indirect prompt injection where a target site could provide instructions to the agent.
[EXTERNAL_DOWNLOADS]: The skill performs numerous automated downloads from non-whitelisted domains using curl and wget, which is used to populate local /tmp files for further processing and execution.

hunt-firebase