The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill performs status checks against well-known public security APIs including hstspreload.org, securityheaders.com, mxtoolbox.com, and dmarcian.com. These are recognized diagnostic services for security research and do not represent a malicious external download or command-and-control communication.
[COMMAND_EXECUTION]: The skill provides numerous example commands using standard security tools like curl, dig, openssl, testssl.sh, and nmap. These are intended for local execution by a security researcher against a target domain and do not involve unauthorized command injection or privilege escalation.
[REMOTE_CODE_EXECUTION]: The automated scan flagged a piped command to python3 -m json.tool from hstspreload.org. Analysis confirms this is safely piping JSON data from a well-known HSTS status API to the standard Python JSON formatting module for display purposes. This is a common and safe developer practice for pretty-printing API responses.
[PROMPT_INJECTION]: The skill uses instructional language to guide the AI's behavior ('Reality Check', 'Do not report standalone'), but these are within the scope of defining the skill's purpose and helping the AI triage vulnerabilities accurately. There are no attempts to bypass safety filters or extract system prompts.
[DATA_EXFILTRATION]: No patterns of sensitive data access (e.g., credentials, private keys, environment variables) or exfiltration to third-party servers were detected. The network operations are limited to scanning the target domain provided by the user.

hunt-tls-network