The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides multiple bash scripts that automate reconnaissance against external targets. It uses loops to execute curl commands and local system utilities like grep, jq, and tee to process data from remote servers.
[DATA_EXFILTRATION]: The instructions direct the agent to specifically search for and extract highly sensitive Personally Identifiable Information (PII) including email addresses, physical addresses, phone numbers, Social Security Numbers (SSNs), and credit card information from exposed debug logs and directory listings.
[REMOTE_CODE_EXECUTION]: An automated scan flagged the command piping crt.sh output to python3 as a remote code execution risk. Manual analysis confirms this is a false positive: the Python interpreter is used to execute a static, safe JSON parsing script provided within the skill's instructions, not to execute content fetched from the remote URL.
[PROMPT_INJECTION]: The skill is vulnerable to Indirect Prompt Injection (Category 8) because it ingests untrusted data from external websites (HTML source, debug logs, and contact form exports) without sanitization.
Ingestion points: Untrusted data enters via curl commands in Phase 2 (/wp-json/wp/v2/users, /wp-content/debug.log) and Phase 3.
Boundary markers: None are present to distinguish between the skill's instructions and the content of the downloaded files.
Capability inventory: The skill has access to subprocess execution (shell commands) and file system writes (tee, -o /tmp/hvac_debug.log).
Sanitization: There is no escaping or validation of the external content before it is processed by the agent or piped to local tools.

recon-hvac