The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes several Windows commands (such as systeminfo, driverquery, sc, and wmic) for system reconnaissance and to interact with services during the exploitation process.
[EXTERNAL_DOWNLOADS]: It includes instructions for fetching exploitation resources and scripts from reputable security research sources on GitHub, including the Empire Project and specialized exploit repositories.
[REMOTE_CODE_EXECUTION]: The skill documents the use of PowerShell's Invoke-Expression (IEX) to download and execute a privilege escalation script (Invoke-MS16032.ps1) directly from a public GitHub repository.
[DATA_EXFILTRATION]: Reconnaissance data about the target system is redirected to local temporary files (e.g., C:\Windows\Temp\systeminfo.txt) to facilitate offline analysis.
[PROMPT_INJECTION]: The skill ingests data from system command outputs, creating a potential surface for indirect prompt injection.
Ingestion points: Output from commands like systeminfo and driverquery in SKILL.md.
Boundary markers: No delimiters are specified when processing this ingested system data.
Capability inventory: The skill has broad capabilities, including subprocess execution via cmd.exe and powershell.exe, and network connectivity via tools like Metasploit.
Sanitization: There is no evidence of sanitization or validation for the system-generated data before it is used by the agent.

windows-kernel-exploits