The Agent Skills Directory

[DATA_EXFILTRATION]: The skill provides explicit payloads for reading sensitive system files such as /etc/passwd and win.ini using XML External Entities (XXE) and the XSLT document() function. It also includes SSRF patterns for making outbound network requests to attacker-controlled domains.
[REMOTE_CODE_EXECUTION]: Payloads are included that demonstrate how to achieve remote code execution through multiple language-specific extensions, including Java reflection (java.lang.Runtime), PHP function calls (readfile, scandir, assert), and .NET script blocks.
[COMMAND_EXECUTION]: The skill contains functional examples of executing shell commands such as id, whoami, and ping through the XSLT processor's underlying operating system shell.
[DYNAMIC_EXECUTION]: The instructions demonstrate techniques for compiling and executing arbitrary code at runtime using msxsl:script and PHP function registration, which are high-risk features in XSLT processors.
[PROMPT_INJECTION]: The AI LOAD INSTRUCTION section provides specific directions for the agent to prioritize chaining exploits and mapping processors, influencing the agent's behavior towards performing automated injection attacks.
[INDIRECT_PROMPT_INJECTION]: The skill focuses on generating malicious payloads intended to be ingested by remote XML/XSLT transformation endpoints.
Ingestion points: Parameters like xslt, stylesheet, and transform (SKILL.md)
Boundary markers: None present in the provided payloads
Capability inventory: Subprocess execution, arbitrary file writes, network operations, and local file access
Sanitization: No sanitization or safety instructions are provided for the generated payloads

xslt-injection