The Agent Skills Directory

[DATA_EXFILTRATION]: The skill provides comprehensive instructions for reading and exfiltrating sensitive local files (e.g., /etc/passwd, /etc/shadow, ~/.ssh/id_rsa, ~/.aws/credentials) to external servers (attacker.com, BURP_COLLABORATOR) using HTTP, FTP, and DNS protocols.
[REMOTE_CODE_EXECUTION]: The documentation includes specific payloads for achieving remote code execution through the PHP expect:// wrapper and XSLT injection targeting Java (Runtime.exec) and PHP (system) environments. It also details a chain for Apache Solr XXE + RCE (CVE-2017-12629) involving JNDI injection.
[CREDENTIALS_UNSAFE]: The skill explicitly targets high-value credentials, specifically providing paths to exfiltrate AWS keys and private SSH keys from the local file system.
[COMMAND_EXECUTION]: Instructions include the use of shell commands such as unzip and zip to manipulate Office document structures for the purpose of injecting malicious XML entities.
[OBFUSCATION]: Various techniques are described to bypass security monitoring, including the use of XML parameter entity encoding (e.g., %), PHP Base64 filters (php://filter/convert.base64-encode), and nested DTD structures to hide malicious intent from shallow inspection.
[INDIRECT_PROMPT_INJECTION]: The skill identifies multiple attack surfaces where processing untrusted data (SVG, OOXML, SAML, etc.) can lead to injection attacks.
Ingestion points: back-end parsers for XML, SVG, OOXML, SOAP, SAML, RSS, and GPX files.
Boundary markers: Absent from the provided instructions.
Capability inventory: Includes network communication and local file system access via XML entity resolution.
Sanitization: The instructions focus on exploiting weaknesses and bypassing existing defenses rather than implementing sanitization.

xxe-xml-external-entity