The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/agent.py utilizes the subprocess.check_output function to invoke external security utilities including GetUserSPNs.py (from the Impacket suite), hashcat, and powershell. This is the intended functionality of the skill to facilitate security testing operations. The use of argument lists in the subprocess calls provides protection against standard shell command injection vulnerabilities.\n- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze external data such as Active Directory user attributes and Windows Event ID 4769 logs. While this creates a potential attack surface where maliciously crafted logs could theoretically influence the agent's detection logic, the impact is limited to the skill's analytical output.\n
Ingestion points: Data enters the environment via LDAP/PowerShell queries in scripts/agent.py and log file parsing in scripts/process.py.\n
Boundary markers: The skill does not implement specific delimiters for processed data.\n
Capability inventory: The agent has the capability to write JSON reports, execute system commands via subprocess, and perform network-based Kerberos requests via external binaries.\n
Sanitization: The skill performs basic parsing and validation of command output and log entries, though it lacks extensive sanitization for adversarial data inputs.

exploiting-kerberoasting-with-impacket