The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill mentions fetching installation scripts for tools like 'wasmtime' from 'wasmtime.dev', which is a well-known project and service in the WebAssembly community.
[REMOTE_CODE_EXECUTION]: Provides instructions for remote script execution (e.g., 'curl | bash') as a method for installing necessary security tooling and delivering exploit payloads.
[COMMAND_EXECUTION]: Leverages a wide array of system utilities and specialized security tools (e.g., 'gdb', 'readelf', 'objdump', 'nc', 'socat', 'radare2') to perform deep binary analysis and technical exploitation tasks.
[PRIVILEGE_ESCALATION]: Documents functional techniques for local privilege escalation (LPE), including overwriting kernel variables like 'modprobe_path' and 'core_pattern', as well as manipulating system files like '/etc/passwd'.
[DATA_EXFILTRATION]: Provides templates and methodology for exfiltrating sensitive data (e.g., challenge 'flags') from target systems using network socket redirection, timing side-channels, and file descriptor manipulation.
[OBFUSCATION]: Outlines methods for bypassing shellcode filters and security scanners through the use of XOR/ADD encoding, Base64, and instruction-level substitutions.
[PERSISTENCE]: Discusses common persistence mechanisms (e.g., shell profiles like '.bashrc', cron jobs, and SSH 'authorized_keys') in the context of maintaining access during a security engagement or CTF.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted binary artifacts and challenge metadata provided by users, which represents an attack surface where malicious instructions could be embedded to influence the agent's behavior.
[DYNAMIC_EXECUTION]: Covers the exploitation of dynamic runtime environments, including JIT compilers, virtual machines, and interpreters, through techniques like bytecode corruption and self-modifying code.

pwn-ctf