The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The skill provides explicit instructions to elevate privileges within cloud environments, including creating new Global Administrators in Azure Active Directory and assigning 'Owner' roles to service principals.
[PERSISTENCE]: Contains patterns for maintaining access across sessions, such as generating backdoor IAM access keys in AWS, resetting service principal credentials, and creating administrative users specifically for persistent access.
[DATA_EXFILTRATION]: Facilitates the bulk extraction of sensitive information through commands that synchronize S3 buckets to local storage, dump Key Vault secrets, and export Azure Automation runbooks and job outputs.
[CREDENTIALS_UNSAFE]: Describes methods for harvesting and storing credentials, including the manual copying of GCP configuration databases from other user profiles and exporting active Azure session contexts (tokens) to local JSON files for reuse.
[EXTERNAL_DOWNLOADS]: Fetches and executes installation scripts and binaries from Amazon Web Services and Google Cloud official domains, and installs third-party security frameworks like Pacu and ScoutSuite from public package registries.
[COMMAND_EXECUTION]: Employs extensive shell and PowerShell operations to probe cloud infrastructure, including the remote execution of scripts on virtual machine instances via cloud management APIs.
[DYNAMIC_EXECUTION]: Utilizes dynamic loading of local scripts (e.g., MSOLSpray) and runtime injection of commands into remote cloud compute instances.
[INDIRECT_PROMPT_INJECTION]: By processing large volumes of external metadata, configuration data, and log files from cloud providers, the skill creates a surface for indirect prompt injection attacks, though this is partially addressed by required user confirmation steps before high-impact actions.

cloud-penetration-testing