The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill utilizes patterns that pipe output from remote network targets directly into a Python interpreter for processing. While these instances are configured for JSON formatting or basic counting, the structural pattern is identified as a high-risk vector for remote code execution if the target returns malicious payloads.
Evidence in SKILL.md: curl -s "http://$TARGET:10255/pods" | python3 -m json.tool
Evidence in SKILL.md: curl -s "http://$TARGET:2379/v2/keys/?recursive=true" | python3 -m json.tool
[COMMAND_EXECUTION]: The skill extensively uses shell commands that incorporate variables (such as $TARGET, $POD, $NS, $TOKEN) without explicit sanitization, creating a potential command injection surface if the agent provides malformed inputs.
Evidence: Shell blocks in Phase 1, Phase 2, and Phase 3 using curl, nmap, and nmap variables.
[DYNAMIC_EXECUTION]: The skill executes dynamic Python code blocks via the -c flag to process JSON data retrieved from the network.
Evidence in Phase 2: python3 -c 'import sys,json;d=json.load(sys.stdin);print(len(d.get("items",[])),"secrets")'
[INDIRECT_PROMPT_INJECTION]: The skill exhibits an attack surface where instructions could be injected via the data retrieved from audited targets.
Ingestion points: Responses from Kubernetes API endpoints, etcd keys, and pod logs ingested via curl and etcdctl.
Boundary markers: None. Untrusted data is directly passed to the agent context or piped to other shell utilities.
Capability inventory: The skill has access to network tools (curl, nmap), WebSocket clients (websocat), and Python interpreters.
Sanitization: No validation or filtering is performed on data retrieved from external IP addresses or services.
[CREDENTIALS_UNSAFE]: The skill identifies and accesses sensitive file paths and cloud metadata services to retrieve credentials.
Evidence: Targeted access to /var/run/secrets/kubernetes.io/serviceaccount/token.
Evidence: Commands targeting the Instance Metadata Service (IMDS) at 169.254.169.254 for AWS, Azure, and GCP to harvest security credentials.

hunt-k8s