The Agent Skills Directory

[DATA_EXFILTRATION]: The skill provides explicit payloads designed for Out-of-Band (OOB) data exfiltration, directing extracted information to external domains controlled by an attacker.
Evidence includes payloads for MSSQL (xp_dirtree), MySQL (LOAD_FILE), and Oracle (UTL_HTTP.REQUEST) targeting attacker-server.com and attacker.com.
[OBFUSCATION]: The skill documents several techniques for bypassing security filters and WAFs by obfuscating SQL keywords and characters.
Evidence includes the use of hexadecimal strings (e.g., 0x61646D696E), inline comments (e.g., UN/*bypass*/ION), and whitespace substitution (e.g., SELECT/**/username) to mask malicious intent.
[COMMAND_EXECUTION]: Provides a comprehensive library of SQL commands and exploitation payloads intended to manipulate database logic and extract sensitive information.
Evidence includes UNION-based, error-based, and time-based extraction techniques, as well as authentication bypass payloads such as ' OR '1'='1 and admin'--.
[EXTERNAL_DOWNLOADS]: Mentions the requirement for SQLMap installation for automated exploitation without providing specific version pinning or official source verification.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a vulnerability surface as it is designed to interact with external, untrusted web application parameters.
Ingestion points: Target web application URLs and parameters.
Boundary markers: Not specified in the instruction set.
Capability inventory: Execution of network requests (via the agent's proxy/browser tools) and generation of complex SQL payloads.
Sanitization: No evidence of input validation or output sanitization before processing external responses.

SQL Injection Testing