The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill contains instructions for downloading and executing scripts and binaries from unverified external sources. It provides a 'Direct copy' installation method using curl from a third-party GitHub repository and demonstrates piping curl outputs directly into shell interpreters (e.g., curl ... | bash). It also prompts the agent to install numerous security tools from arbitrary user-owned repositories using pip and go install.
[DATA_EXFILTRATION]: The skill includes explicit PoC templates designed to exfiltrate sensitive information. Examples show how to Base64-encode environment variables ($GITHUB_ENV) and send them to external domains via curl. It also outlines methods for harvesting cloud provider IAM credentials and repository tokens through SSRF and CI/CD exploitation.
[COMMAND_EXECUTION]: The skill mandates the use of numerous powerful CLI tools for aggressive network scanning and system manipulation. It provides complex shell command strings for reconnaissance and vulnerability discovery, often involving deep system probing such as searching for secrets in source code files and environment variables.
[PRIVILEGE_ESCALATION]: Includes methodologies for escalating privileges, such as escaping Docker containers to reach host root access via privileged mounts and abusing OIDC tokens for lateral movement in cloud environments.
[EXTERNAL_DOWNLOADS]: Directs the agent to fetch various scripts, configuration files, and tools from non-whitelisted domains, including personal GitHub accounts and sites like usestrix.com, without verifying the integrity of the downloaded content.
[PERSISTENCE]: Documents techniques to maintain unauthorized access, such as using detached Docker containers or manipulating GitHub runner IDs to prevent process cleanup after job execution.
[CREDENTIALS_UNSAFE]: Provides extensive regex patterns and search commands for identifying hardcoded tokens, keys, and passwords within the system's source code and configuration files, encouraging the intentional harvest of secrets.
[PROMPT_INJECTION]: Contains instructions for performing prompt injection and system prompt extraction attacks against AI agents. While described as a testing methodology, these instructions could be abused by the agent within its own operating context.
[INDIRECT_PROMPT_INJECTION]: The skill has a high vulnerability surface for indirect injection.
Ingestion points: Processes untrusted external assets (URLs, subdomains, source code) as part of its reconnaissance workflow.
Boundary markers: Lacks explicit delimiters or instructions to ignore embedded commands within the processed data.
Capability inventory: Has extensive shell, network, and file system capabilities.
Sanitization: No evidence of sanitization of external content before use in prompts or tool commands.

bug-bounty