The Agent Skills Directory

[DATA_EXFILTRATION]: The skill transmits the target domain name to https://crt.name/v1/search?apex=$DOMAIN. This endpoint is explicitly flagged as malicious by security scanners, creating a risk that reconnaissance targets are shared with an untrusted or potentially hostile third-party service.
[EXTERNAL_DOWNLOADS]: The skill instructions depend on and execute multiple third-party tools, including subfinder, httpx, dnsx, gotator, puredns, tldbrute, gungnir, and certwatcher. These utilities are downloaded from various external sources and executed locally; without verified integrity checks, they represent a significant supply chain risk.
[COMMAND_EXECUTION]: The script executes shell commands and invokes external binaries using the user-provided $DOMAIN variable. While a basic alphanumeric regex is applied to the domain input, the extensive use of external tools to process these strings increases the potential attack surface for command injection if any of the dependencies handle the input unsafely.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external certificate transparency logs which is then processed by the agent and external tools.
Ingestion points: Data is fetched via curl from crt.sh and crt.name within the scripts in SKILL.md.
Boundary markers: None. The external data is processed directly without delimiters or warnings to ignore embedded instructions.
Capability inventory: The skill performs multiple subprocess calls and network operations via subfinder, httpx, dnsx, and dig across all steps.
Sanitization: There is a regex check on the initial $DOMAIN input, but there is no sanitization or validation of the data returned from the certificate logs before it is passed to other tools.

subdomain-enumeration