The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill uses git clone to download the laravel-ignition-rce exploit tool from an external GitHub repository (github.com/ambionics/laravel-ignition-rce) during the vulnerability assessment phase.
[REMOTE_CODE_EXECUTION]: After downloading the external tool, the skill executes exploit.php using the php interpreter to test the target for the CVE-2021-3129 vulnerability. It also pipes output from curl commands to python3 -m json.tool to format JSON responses from the target's Telescope and Horizon API endpoints.
[COMMAND_EXECUTION]: The skill utilizes several shell commands, including curl, git, php, and python3, to perform fingerprinting, retrieve environment configurations, and execute exploit scripts.
[INDIRECT_PROMPT_INJECTION]:
Ingestion points: The skill ingests data from external targets through curl requests, including HTTP headers, session cookies, environment files (.env), and application logs (laravel.log).
Boundary markers: No explicit boundary markers or delimiters are employed to isolate untrusted data retrieved from the target from the agent's internal instructions.
Capability inventory: The skill operates in an environment with access to curl, git, php, and python3, providing significant capabilities if malicious instructions were embedded in the target's output.
Sanitization: Data retrieved from targets is processed using standard text utilities like grep, cut, and tail without validation or sanitization of the input content.

hunt-laravel