The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests data from the external crt.sh API. This constitutes an attack surface where maliciously crafted certificate metadata could be processed by the agent. However, the skill treats this data strictly as text for extraction and statistical analysis using jq, grep, and sed, without executing the content as code or commands.
[PRIVILEGE_ESCALATION]: The documentation includes sudo commands for the initial installation of prerequisites (curl and jq). These are standard environment setup instructions and are not executed automatically during the skill's runtime.
[EXTERNAL_DOWNLOADS]: The skill communicates with https://crt.sh, which is a well-known and legitimate service used for searching Certificate Transparency logs. This network activity is the intended primary function of the skill.

cert-transparency