The Agent Skills Directory

[OBFUSCATION]: The skill uses binary cloaking to hide its executable nature. The build scripts (poc-src/build.sh and poc-src/Makefile) and various README files explicitly describe a process of masking the ELF magic header. Specifically, the first 4 bytes of compiled binaries are replaced from \x7fELF to CVE\x00 to evade security scanners and EDR solutions that identify executable files by their headers.
[PRIVILEGE_ESCALATION]: The core purpose of the skill is Local Privilege Escalation (LPE). It contains full source code for 88 exploits targeting various kernel vulnerabilities (e.g., Use-After-Free, Race Conditions, Integer Overflows) specifically designed to grant an unprivileged user root access. The skill requires the agent to run with sudo permissions.
[DYNAMIC_EXECUTION]: The skill performs runtime compilation and execution of code. It includes a complete build environment (build.sh, Makefile) to transform C source into cloaked binaries which are then executed via the terminal. This allows the execution of complex logic that is not directly visible in the skill's static scripts.
[COMMAND_EXECUTION]: The skill extensively uses the terminal tool with sudo to execute system-level commands, manage kernel modules, and run the generated exploit binaries.
[DATA_EXFILTRATION]: Multiple included exploits are designed to bypass system permissions to read sensitive files. Evidence in the READMEs and source code (e.g., cve_2017_7308/poc.c) shows the tool attempts to access and read /etc/shadow as proof of successful root acquisition.
[PROMPT_INJECTION]: The SKILL.md contains behavior-overriding instructions that command the AI agent to prioritize and actively trigger this specific skill whenever keywords like 'kernel security' or 'CVE' are mentioned, which attempts to hijack the agent's decision-making process for those domains.

alibabacloud-ecs-sec-kernel