The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests data from external HTTP responses via curl when scanning a target server. This data is then processed using awk, jq, and shell variables. While this creates a surface for indirect prompt injection or tool exploitation if a target provides malicious payloads, it is the fundamental mechanism required for security testing. The skill uses specific command-line flags and parsing logic to handle these inputs, and the risk is inherent to its primary purpose.
[DATA_EXFILTRATION]: The skill performs network operations using curl to reach a target domain specified by the user. These operations are restricted to obtaining session information and testing endpoint responses. There is no evidence of local sensitive data (like credentials or configuration files) being sent to external servers.
[COMMAND_EXECUTION]: The skill includes shell scripts that execute local commands such as curl, awk, jq, and base64. These are used for data transformation and network communication within the scope of security testing. No evidence was found of unsafe command construction using untrusted remote input without proper containment.

hunt-session