The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The skill instructs the user to execute scripts with 'sudo' privileges (e.g., 'sudo bash ./temp_hosts-update.sh' and 'sudo bash ./temp_clock-sync.sh'). These scripts modify sensitive system configuration files such as '/etc/hosts' and change system time settings, facilitating unauthorized privilege elevation on the host machine.
[COMMAND_EXECUTION]: The orchestrator performs extensive local system operations, including file system manipulation ('mkdir', 'cp', 'rm'), permission modifications ('chmod +x'), and network utility execution ('ip addr show', 'getent hosts'). These operations give the agent broad control over the local environment.
[DYNAMIC_EXECUTION]: The skill dynamically generates shell scripts by copying templates and using 'sed' to inject variables before prompting the user for execution. It also executes arbitrary Python code via 'python3 -c' to parse internal configuration files, which is a common vector for code injection.
[INDIRECT_PROMPT_INJECTION]: The skill exhibits a significant attack surface for indirect prompt injection. 1. Ingestion points: The skill downloads and reads untrusted content such as source code via 'git clone' and 'git-dumper', and web application files via LFI. 2. Boundary markers: No delimiters or safety instructions are provided to treat this ingested content as untrusted. 3. Capability inventory: The agent's teammates have access to high-impact tools including 'curl', 'nmap', 'evil-winrm', and remote shell capabilities ('shell-server', 'sliver'). 4. Sanitization: No sanitization or filtering of external content is performed before analysis by 'research' or 'ops' teammates.
[EXTERNAL_DOWNLOADS]: The skill facilitates the download of remote content through tools like 'git' and 'git-dumper'. While intended for security testing, this involves fetching content from untrusted target environments, posing a risk of malicious data ingestion.

red-run-ctf