The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides numerous commands for offensive operations, including unauthorized resource manipulation and security control bypass. Evidence found in SKILL.md includes instructions for disabling CloudTrail logging (aws cloudtrail delete-trail), which is a technique used to evade detection and maintain unauthorized access. It also details privilege escalation techniques such as attaching administrator policies to the current user (aws iam attach-user-policy --policy-arn arn:aws:iam::aws:policy/AdministratorAccess) and creating unauthorized access keys for other users.
[DATA_EXFILTRATION]: The skill includes technical procedures for extracting sensitive data from a target environment. Evidence in SKILL.md describes how to synchronize entire S3 buckets to local storage (aws s3 sync s3://bucket-name ./local-folder), mount snapshotted EBS volumes to external instances for offline inspection, and extract Windows Domain Controller secrets (ntds.dit and SYSTEM files) using external tools.
[REMOTE_CODE_EXECUTION]: The skill facilitates the injection and execution of unauthorized code. In SKILL.md, it provides methods to inject malicious Python code into AWS Lambda functions (aws lambda update-function-code) to achieve persistent administrative access. Additionally, it provides instructions to execute arbitrary shell commands on EC2 instances using the AWS Systems Manager (aws ssm send-command).
[EXTERNAL_DOWNLOADS]: The skill instructs the agent to download and install a wide array of offensive security tools from third-party GitHub repositories that are not on the trusted vendor list. These include Pacu, SkyArk, enumerate-iam, aws_consoler, cloudmapper, s3_objects_check, and dufflebag.
[CREDENTIALS_UNSAFE]: The skill contains detailed procedures for harvesting identity credentials and session tokens from various AWS metadata endpoints, including EC2 IMDSv1/v2 (http://169.254.169.254/latest/meta-data/iam/security-credentials/) and Fargate container environments. It also identifies several API calls that return sensitive credentials or passwords.
[PROMPT_INJECTION]: The skill is vulnerable to Indirect Prompt Injection (Category 8). It ingests untrusted data from external sources (e.g., AWS API responses, S3 bucket listings, Lambda code, and web proxy outputs for SSRF) and possesses high-privilege capabilities including subprocess execution, network operations, and file system mounting. There is no evidence of sanitization or boundary markers (delimiters) to prevent instructions embedded in this untrusted data from influencing agent behavior.

AWS Penetration Testing