The Agent Skills Directory

[COMMAND_EXECUTION]: The 'serial_helper.py' script utilizes the 'subprocess.run' function with 'shell=True' to execute a user-provided 'trigger_script'. This creates a direct sink for arbitrary shell command execution on the host machine.
[PERSISTENCE]: The 'examples.md' file provides explicit instructions for establishing persistent access on target devices, including creating SSH backdoors by adding authorized keys, adding root-equivalent user accounts to the '/etc/passwd' file, and configuring reverse shells within startup scripts.
[PRIVILEGE_ESCALATION]: The skill documentation includes methods for bypassing login authentication via bootloader manipulation and escaping restricted shell environments using various standard binaries such as 'vi', 'find', and 'awk'.
[DATA_EXFILTRATION]: Instructions in 'examples.md' demonstrate how to dump sensitive device firmware partitions using 'dd' and exfiltrate the resulting data over the network using 'nc' (netcat).
[DYNAMIC_EXECUTION]: The 'serial_helper.py' script constructs and executes shell commands at runtime based on agent-provided parameters, specifically through the '--trigger-script' functionality.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a significant attack surface for indirect prompt injection because it ingests and processes untrusted data from a serial console without sanitization. * Ingestion points: Data is read from the serial device (e.g., '/dev/ttyUSB0') via the 'serial_helper.py' script using the 'pyserial' library. * Boundary markers: No boundary markers or instructions to disregard embedded commands are utilized when processing or displaying serial console output to the agent. * Capability inventory: The agent has access to powerful capabilities including file system modification, network communication, and shell command execution. * Sanitization: Serial output is cleaned of formatting codes but remains unsanitized for potential instructions that could influence the agent's behavior.

picocom