The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The installation procedure for the Google Cloud SDK utilizes a direct pipe from curl to bash (curl https://sdk.cloud.google.com | bash). While this is a standard installation method provided by a well-known service, it represents a remote code execution pattern.
[EXTERNAL_DOWNLOADS]: The skill downloads several CLI tools and frameworks from external sources, including the AWS CLI from Amazon's official servers and various security tools like ScoutSuite and Pacu via pip.
[DATA_EXFILTRATION]: Instructions include commands for extracting sensitive data from cloud environments, such as dumping Azure Key Vault secrets (az keyvault secret show), extracting Lambda environment variables, and exporting Azure authentication contexts to local files (Save-AzContext).
[PRIVILEGE_ESCALATION]: The skill provides techniques for escalating privileges within cloud tenants, including assigning service principals to the 'Global Administrator' (Company Administrator) role and creating new administrative users.
[PERSISTENCE]: Detailed methods for establishing long-term access are documented, such as creating backdoor service principals in Azure AD and generating secondary IAM access keys in AWS.
[INDIRECT_PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection as it processes untrusted external data.
Ingestion points: Reads from user-provided files such as users.txt, ips.txt, and passlist.txt in SKILL.md and references/advanced-cloud-scripts.md.
Boundary markers: None identified; data is processed directly via shell loops and PowerShell scripts.
Capability inventory: Significant capabilities including curl, Invoke-AzVMRunCommand (executing code on remote VMs), and broad file system write access via output redirection.
Sanitization: No evidence of input validation or escaping for the contents of the ingested files before they are used in command arguments.
[COMMAND_EXECUTION]: The skill heavily relies on the execution of shell and PowerShell commands to perform its functions, including interaction with VM management APIs (Invoke-AzVMRunCommand).

Cloud Penetration Testing