The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides instructions for the agent to execute network reconnaissance commands using curl against external SharePoint endpoints to identify versions and service states. Evidence: Multiple examples throughout the 'Step-by-Step Hunting Methodology' and 'Payload & Detection Patterns' sections.
[INDIRECT_PROMPT_INJECTION]: The skill acts as a vulnerability surface by ingesting data from external web responses (HTTP headers, JSON, and HTML body content) and processing them with shell utilities. 1. Ingestion points: Target server responses processed in SKILL.md methodology steps. 2. Boundary markers: None. 3. Capability inventory: Network operations via curl, string processing via grep and jq. 4. Sanitization: Uses basic command-line filtering but lacks rigorous input validation for processed data.
[DYNAMIC_EXECUTION]: Uses a Python subprocess call to perform runtime URL-encoding of class names for reconnaissance probes. Evidence: SafeControl enumeration script in Step 6.
[OBFUSCATION]: Includes a Base64-encoded string representing a standard NTLM Type-1 message used for eliciting server topology information. Evidence: Step 5 in methodology. Decoding the string TlRMTVNT... confirms it is a standard protocol artifact and does not contain hidden instructions or malicious payloads.

hunt-sharepoint