The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs users to install the 'shodan' package via official package managers like pip or pacman. This is the official and well-known library for interacting with the Shodan service.
[COMMAND_EXECUTION]: The workflow involves executing Shodan CLI commands for tasks such as host lookup, scanning, and result parsing. These commands are necessary for the primary function of the skill and represent standard security research practices.
[PROMPT_INJECTION]: The skill ingests untrusted data from external sources, specifically service banners and HTML content retrieved via the Shodan API. This creates an attack surface for indirect prompt injection where an attacker could embed malicious instructions in service banners to influence the agent. Ingestion points: Shodan API and CLI search results in SKILL.md. Boundary markers: Not present in prompt construction examples. Capability inventory: Includes shell command execution (shodan CLI) and Python script execution. Sanitization: No sanitization or filtering of banner content is demonstrated in the provided examples.

shodan-reconnaissance