The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The skill is dedicated to identifying and exploiting Windows misconfigurations to escalate privileges from a standard user to Administrator or SYSTEM. It includes techniques for abusing AlwaysInstallElevated registry settings, exploiting unquoted service paths, and hijacking services with weak permissions.
[CREDENTIALS_UNSAFE]: Provides specific instructions and commands to harvest credentials from various locations, including Windows auto-logon settings, WiFi profiles in cleartext via netsh, PuTTY sessions, and VNC configuration keys in the registry.
[DATA_EXFILTRATION]: Outlines procedures for dumping the SAM and SYSTEM registry hives to extract password hashes, which can then be cracked offline, and searching the filesystem for sensitive files containing passwords.
[COMMAND_EXECUTION]: Employs a vast array of high-risk shell commands and third-party exploit binaries (e.g., JuicyPotato, PrintSpoofer, Mimikatz) to perform enumeration and privilege escalation.
[DYNAMIC_EXECUTION]: Recommends generating and executing malicious MSI packages and DLL files to facilitate reverse shells and privilege escalation during service exploitation.
[INDIRECT_PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection as it processes output from system enumeration commands (e.g., systeminfo, wmic, accesschk.exe) that could be manipulated by an attacker on the target host to influence the agent's logic. Evidence: Ingestion points include output from system enumeration commands in SKILL.md; Boundary markers are absent; Capability inventory includes sc, reg, and msiexec in SKILL.md; Sanitization measures are not mentioned.

Windows Privilege Escalation