The Agent Skills Directory

[COMMAND_EXECUTION]: The skill orchestrates the use of numerous external offensive security tools including httpx, naabu, nmap, nuclei, sqlmap, chisel, mimikatz, netexec, bloodhound, and certipy. It provides playbooks for executing these tools to achieve remote command execution and network pivoting.
[PRIVILEGE_ESCALATION]: The methodology provides specific guidance for escalating privileges across Windows (token abuse), Linux (sudo/SUID exploits), and Cloud environments (IAM PassRole/AssumeRole paths). It also covers Active Directory Certificate Services (AD CS) misconfigurations (ESC1–ESC8).
[DATA_EXFILTRATION]: The skill describes processes for mining sensitive data such as cloud keys, connection strings, and credentials from GitHub leaks and instance metadata (IMDS). It frames the exfiltration of 'crown-jewel' data as the final objective of a scoped engagement, requiring anonymization of proof data.
[INDIRECT_PROMPT_INJECTION]: The skill has a significant attack surface as it is designed to ingest and process data from external sources including tech fingerprints, subdomain enumeration, and code leaks. While it includes phase gates and evidence reviews to manage this data, the ingestion of untrusted external content represents a potential vector for indirect injection.
[SAFEGUARD_OBSERVANCE]: The skill includes extensive professional guardrails, including mandatory verification of signed Rules of Engagement (RoE), explicit requirements for written authorization for high-risk actions (DCSync, golden tickets), and strict instructions to never impact availability or touch real user data.

tradecraft-attack-chain