The Agent Skills Directory

[OBFUSCATION]: The skill contains Base64-encoded binary data within an HTML smuggling template in SKILL.md, specifically using atob() to decode a Portable Executable (PE) header.
[REMOTE_CODE_EXECUTION]: Provides instructions and code for downloading and executing remote scripts, such as using PowerShell Invoke-WebRequest piped to Invoke-Expression (IEX) targeting suspicious domains.
[COMMAND_EXECUTION]: Includes functional command-line examples for various offensive tools including msolspray, nuclei, searchsploit, and credential cracking tools like asleap.
[DYNAMIC_EXECUTION]: Employs JavaScript Blob and ObjectURL methods to dynamically assemble and trigger binary downloads at runtime. It also includes an AMSI bypass script that uses .NET reflection to patch system utilities in memory.
[PRIVILEGE_ESCALATION]: Details multiple techniques for bypassing host security, including PowerShell execution policy bypasses, SmartScreen evasion, and methods to remove the Mark-of-the-Web (MOTW) from downloaded files.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted inputs such as target_profile and payload which are interpolated into shell commands and templates without boundary markers or sanitization, creating an exploitation surface.
[PERSISTENCE]: The skill body provides instructions for establishing persistence on target systems using registry keys and scheduled tasks.

initial-access