The Agent Skills Directory

[DATA_EXFILTRATION]: Provides functional payloads for exfiltrating sensitive browser data, such as cookies, to external attacker-controlled domains and harvesting cloud metadata via SSRF.
[REMOTE_CODE_EXECUTION]: Contains a library of RCE payloads for multiple back-end environments (Python, PHP, Java, Ruby, Node.js) that utilize dangerous system calls like popen, execSync, and system.
[COMMAND_EXECUTION]: Documents extensive shell command injection techniques, including methods for piping command output to external servers and bypassing signature-based detection.
[CREDENTIALS_UNSAFE]: Instructions explicitly target sensitive credential stores including AWS configuration files, SSH private keys, and environment variables (.env).
[OBFUSCATION]: Provides detailed examples and implementations of obfuscation techniques—such as Base64, hex encoding, and Unicode homoglyphs—designed specifically to evade security filters and WAFs.
[PRIVILEGE_ESCALATION]: Outlines sophisticated methods for authentication bypass and privilege escalation, including SAML signature wrapping, JWT manipulation, and IDOR attacks.
[DYNAMIC_EXECUTION]: Includes template injection payloads that leverage runtime execution sinks (eval, Function constructor) to execute arbitrary code on the host server.
[EXTERNAL_DOWNLOADS]: References the acquisition of external security tools and wordlists from public GitHub repositories and local file paths.

security-arsenal