The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides an embedded Python script for performing automated blind LDAP extraction. It uses the requests library to programmatically send injection payloads and interpret server responses.
[DATA_EXFILTRATION]: The skill is designed to identify and extract sensitive directory attributes, including userPassword, mail, sAMAccountName, and description. It instructs the agent to save this harvested data to the local filesystem under the engagement/evidence/ directory.
[INDIRECT_PROMPT_INJECTION]: The automated extraction logic processes untrusted data from target application responses to drive its decision-making loop.
Ingestion points: HTTP response body content returned from the target URL in the check() function.
Boundary markers: Absent; the script performs a simple substring check for a SUCCESS_INDICATOR within the unvalidated response text.
Capability inventory: Use of Python requests for outbound network operations and local file writes for evidence logging.
Sanitization: No sanitization or escaping is performed on the data received from the target before processing.

ldap-injection