The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides numerous shell commands for interacting with AWS services via the AWS CLI, including enumerating users, roles, and resources.
[DATA_EXFILTRATION]: Contains specific instructions for extracting sensitive data, including temporary credentials from the EC2 metadata endpoint (IMDSv1 and v2), Fargate container credentials from environment variables, and mounting EBS snapshots to steal data from offline volumes.
[PRIVILEGE_ESCALATION]: Details various 'Shadow Admin' techniques to gain administrator rights, such as creating access keys for other users, attaching administrative policies to the current user, and injecting malicious Python code into Lambda functions to perform privilege escalation on behalf of the attacker.
[PERSISTENCE]: The skill documentation explicitly mentions 'Persistence techniques for red team operations' and 'Persistence mechanisms' as intended outputs. It includes methods for converting CLI credentials to console access to maintain long-term control.
[EXTERNAL_DOWNLOADS]: Instructs the user to download multiple security and exploitation tools from third-party GitHub repositories, including RhinoSecurityLabs/pacu, andresriancho/enumerate-iam, NetSPI/aws_consoler, and duo-labs/cloudmapper.
[COMMAND_EXECUTION]: Includes instructions for using AWS Systems Manager (SSM) to execute arbitrary shell commands on EC2 instances (aws ssm send-command).
[DATA_EXFILTRATION]: Provides guidance on disabling or obfuscating CloudTrail logs to hide malicious activity, which facilitates undetected data exfiltration and persistence.

AWS Penetration Testing