The Agent Skills Directory

[SAFE]: The skill serves as a comprehensive educational guide and repository of common RCE hunting patterns, including template injection, dependency confusion, and path traversal.
[REMOTE_CODE_EXECUTION]: Automated scanners flagged two instances of curl | bash patterns. These occur within the documentation context of the ActiveStorage Path Traversal and SQLi + COPY FROM PROGRAM sections as examples of how RCE occurs in vulnerable systems. They are not instructions for the agent to execute against the user's environment.
[COMMAND_EXECUTION]: The skill lists numerous shell commands (e.g., id, whoami, nslookup, kubectl) and payload operators. These are documented as 'Attack Surface Signals' and 'Payload & Detection Patterns' intended to help security researchers identify vulnerabilities, rather than being part of a malicious execution flow.
[PROMPT_INJECTION]: The skill includes instructions like 'Rule: If the page has an HTML form... use form-encoding.' These are technical guidelines for the security researcher (the user) on how to conduct manual testing, not attempts to subvert the AI agent's internal safety filters.
[DATA_EXFILTRATION]: Examples of out-of-band (OOB) callbacks using burpcollaborator or canarytokens.org are described as methods for researchers to confirm blind RCE. No actual exfiltration of user data is performed by the skill code.

hunt-rce