The Agent Skills Directory

[PROMPT_INJECTION]: The SKILL.md file contains a direct instruction at the top ('AI LOAD INSTRUCTION') commanding the AI to adopt an 'Expert SSTI' persona and utilize specific exploitation techniques, overriding standard safety constraints.\n- [REMOTE_CODE_EXECUTION]: The skill provides a comprehensive library of RCE chains for multiple engines, including Jinja2 (using subclasses/Popen), FreeMarker (utility.Execute), Twig (system/exec via filter maps), and Velocity (Runtime.exec), specifically designed to gain control of the host server.\n- [COMMAND_EXECUTION]: Payloads across all files include dangerous shell commands such as 'id', 'cat /etc/passwd', 'sleep 5', and 'nslookup' for both direct and blind exploitation.\n- [DATA_EXFILTRATION]: Section 11 of SKILL.md and Section 4 of ENGINE_PAYLOADS.md describe methods for exfiltrating sensitive environment variables, application configuration files, and system passwords.\n- [CREDENTIALS_UNSAFE]: The skill explicitly instructs the agent to target and read highly sensitive credential files, such as '~/.aws/credentials' and application-level secrets.\n- [PERSISTENCE]: Post-exploitation instructions in SKILL.md include the use of a 'Reverse shell for persistence' to maintain access to the compromised system.\n- [OBFUSCATION]: The skill uses hex encoding (e.g., '\x5f\x5f' for underscores) in Jinja2 chains and Base64 encoding in SCENARIOS.md to hide malicious PHP code and bypass security filters.\n- [METADATA_POISONING]: Automated reputation scans have confirmed that SCENARIOS.md contains malicious patterns, triggering a critical alert.

ssti-server-side-template-injection