The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to use shell commands like apktool for decompiling mobile applications, adb for interacting with Android deep link handlers, and grep for analyzing source code.
[EXTERNAL_DOWNLOADS]: Performs network requests to target domains using curl to fetch configuration files and evaluate response headers during OAuth flow testing.
[PROMPT_INJECTION]: The skill has an indirect prompt injection surface as it ingests untrusted data from remote endpoints and local application files while possessing capabilities like curl and adb. Evidence Chain: 1. Ingestion: Remote target responses and decompiled APKs; 2. Boundary Markers: Absent; 3. Capabilities: curl, adb, apktool, grep; 4. Sanitization: Absent.
[REMOTE_CODE_EXECUTION]: Manual review of the automated alert regarding piping curl to python3 shows the command is curl ... | python3 -m json.tool. This is a safe usage of a built-in formatting module and does not execute arbitrary remote code.
[PROMPT_INJECTION]: Documents techniques for bypassing OAuth security filters, including host confusion and homograph attacks, as part of its security hunting methodology.

hunt-oauth