The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from target organizations, which presents a surface for indirect prompt injection.
Ingestion points: Fetches content from external JS bundles via curl, and retrieves package.json, requirements.txt, and GitHub Actions workflow files via the GitHub API (gh api).
Boundary markers: None identified; the skill does not wrap external content in delimiters or provide instructions to the agent to ignore embedded instructions within the fetched data.
Capability inventory: The skill utilizes curl, gh, jq, grep, and docker, providing a significant capability set if an injection were successful.
Sanitization: No evidence of sanitization, escaping, or validation of the external content before it is processed by the agent.
[COMMAND_EXECUTION]: The skill makes extensive use of shell commands and utilities to perform its reconnaissance tasks.
Evidence: Uses curl for network requests to registries and target websites, gh for GitHub organization and repository enumeration, and docker for image inspection.
[EXTERNAL_DOWNLOADS]: The skill performs downloads from various remote sources.
Evidence: Fetches package metadata from well-known registries including registry.npmjs.org, pypi.org, and rubygems.org. It also suggests using docker pull to retrieve container images from registries like Docker Hub and GHCR.
[DYNAMIC_EXECUTION]: The skill employs dynamic execution for string manipulation and logic processing.
Evidence: Step 5 uses python3 -c to execute a Python snippet that generates typosquatting name candidates.

supply-chain-attack-recon