The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill requires the installation of the holehe social media account enumeration tool via pip.
[COMMAND_EXECUTION]: The skill executes several system commands including curl for API requests, dig for DNS lookups, and holehe for OSINT scanning.
[DYNAMIC_EXECUTION]: Python one-liners are used to safely process JSON responses and perform URL encoding of inputs. The risk of command injection is mitigated by a strict regular expression validation of the email input in Step 1.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external API responses (Have I Been Pwned).
Ingestion points: JSON responses from haveibeenpwned.com fetched via curl in Step 2 and Step 3.
Boundary markers: None present; API results are written directly to the output file and displayed to the user.
Capability inventory: The skill has capabilities to write to the file system (mkdir, tee), perform network requests (curl, holehe), and execute system commands (dig, python3).
Sanitization: The skill extracts specific fields from the JSON response using Python's json module, which prevents raw data from being interpreted as instructions by the shell, although it does not filter the content of the strings returned by the API.

osint-email