The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The skill explicitly directs the agent to ensure high-privilege tokens are enabled, specifically mentioning SeDebugPrivilege, SeTcb, and SeImpersonatePrivilege. It also provides instructions for using the KSystemInformer.sys kernel driver to bypass Protected Process Light (PPL) protections and access restricted memory regions.
[COMMAND_EXECUTION]: The documentation includes a PowerShell recipe for using rundll32.exe with comsvcs.dll to generate a full MiniDump of a process. This is a common Living-off-the-Land (LotL) technique often leveraged for credential harvesting and sensitive data extraction.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data and presents a surface for injection: Ingestion points include process command lines, environment blocks, and network socket metadata; Boundary markers are not utilized in the provided scripts; Capability inventory includes subprocess execution, direct memory reading via ctypes, and kernel-level manipulation; Sanitization of system-provided strings is not implemented in the examples.
[DYNAMIC_EXECUTION]: The skill utilizes Python ctypes to dynamically interface with native system libraries like ntdll.dll and kernel32.dll at runtime. Additionally, it provides a development workflow for authoring and loading custom C/C++ plugins (DLLs) into the System Informer process.

system-informer