The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill provides instructions to download and install the nuclei tool from the ProjectDiscovery GitHub repository. ProjectDiscovery is a well-known and established vendor in the security community.
[COMMAND_EXECUTION]: The skill guides the agent to execute shell commands using the nuclei binary to perform security audits on user-provided URLs.
[PROMPT_INJECTION]: The skill contains an attack surface for indirect prompt injection as it processes untrusted data from external web targets.
Ingestion points: The agent is instructed to read and parse the nuclei-results.jsonl file in SKILL.md, which contains data retrieved from external network hosts.
Boundary markers: The instructions lack specific boundary markers or warnings to the agent to disregard instructions potentially embedded within the scan results.
Capability inventory: The skill has command execution capabilities to run the scanner binary.
Sanitization: There is no explicit sanitization step for the data read from the scan results before it is presented to the user or processed by the agent.

dast-nuclei