The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes the terminal tool to execute the sherlock command-line utility to perform reconnaissance across various social networks.- [EXTERNAL_DOWNLOADS]: The skill instructions direct the agent to install the sherlock-project package from PyPI using pip or pipx if the command is not already available.- [PROMPT_INJECTION]: The skill contains a surface for indirect prompt injection (specifically command injection) by interpolating user-supplied usernames directly into a shell command template. While double quotes are recommended, a malicious username containing shell metacharacters could potentially result in arbitrary command execution depending on the host environment and agent sanitization. Ingestion points: User-provided usernames extracted from conversation history (SKILL.md). Boundary markers: Double quotes are used around the username variable in the command templates. Capability inventory: Terminal tool execution for shell commands (SKILL.md). Sanitization: No explicit sanitization or validation logic is defined in the skill instructions.

sherlock