The Agent Skills Directory

[OBFUSCATION]: The skill includes multiple Base64 encoded strings within code blocks to serve as training examples for concealment detection. For instance, SKILL.md contains a Base64 string that decodes to a shell command (touch /tmp/aegis-canary-hit), while references/background.md uses Base64 as a placeholder for potentially malicious payloads.
[REMOTE_CODE_EXECUTION]: Both SKILL.md and references/background.md provide code examples using child_process.execSync to execute commands derived from Base64 strings. This pattern demonstrates the execution of dynamically decoded content, a common RCE vector.
[DATA_EXFILTRATION]: In references/background.md, the bootstrap.js example script demonstrates how to harvest environment variables matching sensitive patterns such as KEY, TOKEN, SECRET, and PASS. The script then passes these credentials to an external shell command, modeling a data exfiltration flow.
[COMMAND_EXECUTION]: The skill provides a 'Paste-ready read-only sweep block' in SKILL.md, which is a comprehensive shell script intended to be executed by the user or agent. The script runs various file system search tools (rg, find, grep) and identifies potentially executable artifacts.
[PRIVILEGE_ESCALATION]: The auditing shell script and the regex patterns provided for identification (e.g., fence F20 in SKILL.md) explicitly include logic to detect and reference sudo usage for privilege escalation.
[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to ingest and audit large source trees and dependency graphs, creating a substantial attack surface for indirect prompt injection via untrusted data.
Ingestion points: Processes raw source files, build scripts, and dependency manifests across an entire repository (SKILL.md).
Boundary markers: The instructions do not define boundary markers to prevent the agent from executing instructions found within the audited files.
Capability inventory: The skill contains logic for remote code execution and provides a shell script for auditing file contents (SKILL.md, background.md).
Sanitization: There is no description of sanitization or filtering to handle adversarial content embedded in the audited data.

aegis-malicious-code