The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides Python and Bash scripts intended for execution by the agent to automate security testing tasks. These scripts include logic for iterating through numerical identifiers, harvesting IDs from API responses, and performing automated HTTP method bypass tests.
[DATA_EXFILTRATION]: The core methodology involves accessing and extracting sensitive data from target systems, such as user profiles, emails, and phone numbers, to confirm the presence of authorization vulnerabilities. This behavior is the intended primary function of the security auditing skill.
[INDIRECT_PROMPT_INJECTION]:
Ingestion points: The skill is designed to process external data retrieved from target API endpoints, including JSON, XML, and multipart form-data responses in references/idor-advanced-patterns.md and references/idor-bypass-techniques.md.
Boundary markers: The instructions do not define specific delimiters or guardrails for handling potentially malicious content embedded within target API responses.
Capability inventory: The skill utilizes network capabilities (requests library, curl commands) and suggests using internal tools like evidence_save and report_vuln to document findings.
Sanitization: There is no explicit mention of sanitizing or escaping content retrieved from external targets before it is processed or included in vulnerability reports.

idor-methodology