The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill provides complete Python scripts designed for the agent to execute, including a brute-force utility for 6-digit OTP codes and a multi-threaded script for exploiting Time-of-Check to Time-of-Use (TOCTOU) race conditions in 2FA verification.
[COMMAND_EXECUTION]: Multiple high-risk command patterns are included, such as using ffuf for large-scale brute-forcing of 8-digit backup codes and curl for manipulating HTTP responses and attempting direct navigation bypasses.
[DATA_EXFILTRATION]: Instructions include using curl to search for sensitive data like hardcoded OTPs in JavaScript files and response bodies. Additionally, the skill directs the agent to save sensitive data (e.g., AWS credentials, user dumps) to a local evidence directory.
[PROMPT_INJECTION]: The skill instructs the agent to ignore standard authentication controls and actively assist in bypassing 2FA mechanisms, which is an attempt to override safety boundaries regarding unauthorized access.
[INDIRECT_PROMPT_INJECTION]: The skill ingests data from a 'state MCP server' via get_state_summary() without boundary markers or sanitization, creating an attack surface where compromised state information could influence agent behavior.

2fa-bypass