The Agent Skills Directory

[SAFE]: The skill provides instructional guidance for using well-known external OSINT services including FOFA, Quake, and Hunter. These services are recognized as legitimate security intelligence providers.
[SAFE]: The skill instructs the agent to use environment variables (e.g., ${FOFA_KEY}, ${QUAKE_TOKEN}) for API authentication, which follows security best practices for credential management and prevents hardcoding sensitive secrets.
[COMMAND_EXECUTION]: The skill provides shell command templates (using curl) for interacting with the search engine APIs. These commands are transparent, use standard parameters, and are intended for data retrieval from documented endpoints.
[PROMPT_INJECTION]: The skill describes a workflow that involves ingesting and analyzing data from external sources, such as website titles and server headers retrieved via API. This creates a surface for Indirect Prompt Injection, where an attacker-controlled resource could contain instructions intended to influence the agent's subsequent behavior. The skill however contains no instructions to bypass safety filters or ignore system prompts.

passive-recon