The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's primary purpose is the analysis of external targets, including their HTTP responses, JavaScript code, and repository contents. This ingestion of untrusted data creates a potential surface for indirect prompt injection where a malicious target could attempt to influence the agent's logic.
Ingestion points: Data retrieved from web targets (headers, body content) and source code analyzed via grep (SKILL.md).
Boundary markers: The methodology does not specify delimiters or instructions to ignore embedded content in processed data.
Capability inventory: The skill utilizes network requests (curl) and local script execution (python, ruby) for diagnostic purposes.
Sanitization: There are no explicit instructions for sanitizing or escaping content retrieved from external targets.
[DYNAMIC_EXECUTION]: The skill includes instructions to execute localized, template-based Python and Ruby snippets to test for Regular Expression Denial of Service (ReDoS) vulnerabilities.
Evidence: Example timing-based detection commands using ruby -e and python3 -c in the methodology section.
[COMMAND_EXECUTION]: The hunting methodology relies on common CLI tools for interaction and reconnaissance.
Evidence: Extensive use of curl for testing headers and payloads, and grep for searching patterns in source code.

hunt-misc