The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze responses from external web applications, creating a vulnerability surface for instructions embedded in those responses.
Ingestion points: Analyzes HTTP headers, tech detection results, and scan outputs from curl, httpx, nuclei, wfuzz, and ffuf (documented in SKILL.md and references/scan-methodology.md).
Boundary markers: Absent; there are no instructions to use delimiters or ignore instructions found within the retrieved content.
Capability inventory: Executes network operations (curl, nuclei, wfuzz, ffuf) and analyzes sensitive local/remote file paths.
Sanitization: Absent; the skill does not instruct the agent to sanitize or escape data retrieved from external targets before analysis.
[COMMAND_EXECUTION]: The skill provides instructions for the agent to execute several command-line tools for security testing.
Evidence: SKILL.md contains specific command templates for httpx, nuclei, spray, and ffuf. references/scan-methodology.md provides advanced examples for wfuzz including data fuzzing and proxy configuration.
[DATA_EXPOSURE]: The methodology explicitly directs the agent to search for and identify sensitive configuration files that may contain credentials.
Evidence: SKILL.md (Phase 2.3) instructs the agent to look for .env, config.php, web.config, and source code repositories like /.git or .svn to retrieve internal information and database passwords.

web-vuln-scan