The Agent Skills Directory

[SAFE]: The skill serves as an educational resource for vulnerability research. It outlines methodologies for testing authorization boundaries, invitation flows, and session management.
[COMMAND_EXECUTION]: The skill contains multiple examples of shell commands (curl, dig, grep, ruby -e) and JavaScript snippets. These are explicitly presented as payload patterns and detection steps for use by a human security researcher on external targets. There are no instructions for the agent to execute these commands on the local host or without user intervention.
[CREDENTIALS_UNSAFE]: Security is maintained through the use of descriptive placeholders such as INVITE_TOKEN, MAINTAINER_TOKEN, SUSPENDED_INSTALL_ID, and ghp_MINIMAL_SCOPE_TOKEN. No actual secrets or API keys are hardcoded in the skill.
[EXTERNAL_DOWNLOADS]: The skill references well-known technology platforms (GitHub, GitLab, Shopify) and public registries (PyPI, npm) as example attack surfaces. It does not contain instructions to download or execute third-party scripts or binaries.
[PROMPT_INJECTION]: The instructions focus on guiding the agent to assist in vulnerability hunting within established safety boundaries. There are no attempts to bypass system constraints or override safety protocols.
[DATA_EXFILTRATION]: No patterns associated with credential harvesting, unauthorized file access, or exfiltration of sensitive information to remote servers were identified.

hunt-misc