The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The SKILL.md file contains instructions to download a docker-compose.yml file from https://ghst.ly/getbhce. The use of a URL shortener obscures the final destination and the origin of the file, making it an untrusted source.\n- [REMOTE_CODE_EXECUTION]: The workflow proceeds to execute docker compose up -d on the downloaded file. This allows for arbitrary container execution and system configuration changes defined by the untrusted external source.\n- [COMMAND_EXECUTION]: The scripts/agent.py script uses subprocess.run to execute bloodhound-python. The command is built using arguments like domain and dc_ip taken directly from user input without validation, which could be exploited if the underlying tool is vulnerable to specific flag injections.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes Active Directory data which is externally controlled.\n
Ingestion points: Data is loaded from JSON files in scripts/process.py and via database queries in scripts/agent.py.\n
Boundary markers: None present to delimit untrusted data from instructions.\n
Capability inventory: Subprocess execution and file writing capabilities are present in the provided scripts.\n
Sanitization: There is no evidence of data sanitization or validation before the AD data is reported or processed.\n- [METADATA_POISONING]: There is a discrepancy between the author listed in the frontmatter (mahipal) and the copyright holder in the LICENSE file (mukul975), which can lead to confusion regarding the skill's origin and maintenance.\n- [CREDENTIALS_UNSAFE]: The scripts/agent.py script accepts Active Directory credentials (--ad-pass) as command-line arguments. This is an insecure practice as it may expose passwords in process lists or shell command history.

conducting-internal-reconnaissance-with-bloodhound-ce