The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides detailed examples of payloads for arbitrary command execution using Python's subprocess.check_output and builtins.open to demonstrate exploitation of deserialization vulnerabilities.
[DATA_EXFILTRATION]: Includes a 'Runnable Probe' Python script that uses urllib.request to send data to external, non-whitelisted domains (https://target/agent/parse and http://YOUR_IP:8000/xxe) as part of a security test. It also documents techniques for exfiltrating data via OOB (Out-of-Band) channels like DNS using nslookup.
[INDIRECT_PROMPT_INJECTION]: Identifies an attack surface where AI agent tools ingest and process untrusted structured data formats (YAML, JSON, XML, etc.) which can be used to inject malicious instructions.
Ingestion points: Tools described as process_config, parse, load, import, and apply in SKILL.md are identified as entry points for untrusted data.
Boundary markers: The skill does not define specific delimiters or security instructions to isolate external data from the execution environment.
Capability inventory: The skill notes that the agent environment has capabilities for subprocess execution, file system access, and network requests across multiple scripts, which are the primary sinks for the identified vulnerabilities.
Sanitization: The skill describes the lack of sanitization in common parsers (e.g., yaml.load vs safe_load) as the root cause of the vulnerabilities it targets.
[DYNAMIC_EXECUTION]: Describes the use of language-specific features (e.g., Python's !!python/object/apply) and unsafe deserialization methods like pickle.loads and torch.load to execute arbitrary code at runtime. It also references the use of the Fickling tool for behavioral injection in model artifacts.

hunt-agent-deserialization