The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to use curl for probing external target endpoints and grep for searching source code for dangerous JavaScript sinks.
[DATA_EXPOSURE_AND_EXFILTRATION]: Describes methods for verifying vulnerabilities by exfiltrating data, such as session cookies, to Out-of-Band (OOB) listeners like Burp Collaborator.
[OBFUSCATION]: Contains documentation on using Base64, hex, and HTML entity encoding (e.g., 'YWxlcnQoMSk=') as techniques to bypass Web Application Firewalls (WAFs) and sanitizers during security testing.
[INDIRECT_PROMPT_INJECTION]: The hunting methodology involves interacting with untrusted content from external websites, creating a surface for indirect prompt injection. The skill provides guidance on using unique, random markers to verify reflections and minimize false positives.
Ingestion points: HTML responses from external target URLs collected via curl (SKILL.md).
Boundary markers: Recommends the use of unique, random alphanumeric markers (e.g., __ZZ_MARKER_<random>_ZZ__) to identify reflected input.
Capability inventory: Network requests (curl) and shell command execution (grep).
Sanitization: Focuses on detecting reflection; does not specify automated sanitization for the agent's internal processing of target data.
[DYNAMIC_EXECUTION]: Documents the use of dynamic sinks such as eval() and atob() in payloads for client-side execution in a target's browser.

hunt-xss