The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides various command-line instructions for the agent to use during security assessments, including curl for interacting with web services, python3 for running utility scripts like json2paths.py, and kr (Kiterunner) for automated endpoint discovery.
[EXTERNAL_DOWNLOADS]: A dedicated tools reference section contains links to external security projects and resources hosted on GitHub, Netlify, and other platforms (e.g., SecLists, Astra, Kiterunner). These are provided for the user's or agent's reference and are not automatically installed or executed by the skill.
[PROMPT_INJECTION]: The skill facilitates the processing of external data such as Swagger/OpenAPI documentation and API responses.
Ingestion points: Processes swagger.json, openapi.json, and live API endpoint responses (e.g., from target.com).
Boundary markers: No specific delimiters or instructions are provided to the agent to distinguish between trusted instructions and untrusted data from these sources.
Capability inventory: The agent has access to networking tools (curl) and script execution (python3) to act upon findings.
Sanitization: No explicit sanitization or validation of the input documentation is mentioned.
[DATA_EXFILTRATION]: The skill documents a method for identifying IP disclosure vulnerabilities using iplogger.com, an external service that logs the IP addresses of incoming requests. This is presented as an attack technique for testing PDF export functionality.

api-fuzzing-bug-bounty