The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill instructs the agent to download and run external scripts from a third-party repository.\n
Evidence: The workflow includes cloning a repository from GitHub (swisskyrepo/SSRFmap) and executing its contained Python scripts directly.\n- [DATA_EXFILTRATION]: The skill provides detailed methods for accessing and retrieving highly sensitive information from the local system and cloud environments.\n
Evidence: It includes payloads to read files such as /etc/passwd, /proc/self/environ, and ~/.aws/credentials. It also targets cloud metadata services (AWS, GCP, Azure, DigitalOcean) to retrieve IAM security tokens and instance identity details.\n- [COMMAND_EXECUTION]: The skill utilizes several command-line utilities to perform network operations and scan internal services.\n
Evidence: The instructions use curl, git, python3, interactsh-client, and gopherus for various exploitation and testing tasks.\n- [EXTERNAL_DOWNLOADS]: The skill downloads software from third-party sources not included in the trusted vendor list.\n
Evidence: The SSRFmap utility is downloaded from a third-party GitHub account to facilitate automated scanning.\n- [PROMPT_INJECTION]: The skill presents an attack surface for indirect prompt injection by processing external, untrusted data.\n
Ingestion points: The agent ingests data from tool outputs, including interactsh-client logs, curl responses, and SSRFmap results (SKILL.md).\n
Boundary markers: No boundary markers or instructions are provided to the agent to treat external content as untrusted or to ignore embedded instructions.\n
Capability inventory: The skill has access to network requests, file system reads, and shell command execution.\n
Sanitization: There is no evidence of sanitization or validation performed on data fetched from external URLs before it is processed by the agent.

ssrf