The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the user to download and run third-party security tools like lazyegg.py, subjs, and waybackurls. These tools are not from trusted organizations or well-known services, which can lead to the execution of unverified code.
[COMMAND_EXECUTION]: A Node.js snippet in SKILL.md uses node -e to execute code that writes files to the local directory using fs.writeFileSync. The data for these files is sourced directly from untrusted .js.map files retrieved from external websites.
[COMMAND_EXECUTION]: The skill uses shell scripts to automate the downloading of numerous JavaScript files from remote targets, potentially leading to the ingestion of large amounts of unverified data.
[PROMPT_INJECTION]: The skill is highly vulnerable to indirect prompt injection as it is designed to fetch and process untrusted JavaScript code from the web.
Ingestion points: The scan_js.py script and various shell commands in SKILL.md fetch content from external URLs.
Boundary markers: None are present to prevent the agent from following instructions embedded in the analyzed JavaScript files.
Capability inventory: Includes file system writes via Node.js and network access via curl and requests.
Sanitization: Content is processed using regular expressions without validation or sanitization, allowing malicious code embedded in source files to potentially influence the agent's behavior.
[COMMAND_EXECUTION]: The scripts/scan_js.py file disables SSL certificate verification (verify=False), which exposes the network requests to man-in-the-middle (MITM) attacks.

js-secrets-extraction