The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides numerous commands for offensive security tools including Nmap for port scanning, Metasploit for exploitation, and Hydra for brute-force attacks against SSH and FTP services.
[COMMAND_EXECUTION]: Includes instructions for establishing persistence on a target system by modifying the SSH authorized keys file (~/.ssh/authorized_keys) and adding scheduled tasks to the system crontab (/etc/crontab).
[COMMAND_EXECUTION]: Provides techniques for privilege escalation, including commands to identify SUID binaries and check sudo permissions (sudo -l).
[DATA_EXFILTRATION]: Contains instructions for accessing sensitive files such as /etc/passwd and using OSINT techniques to find exposed configuration files (.config) and environment variables (.env).
[CREDENTIALS_UNSAFE]: Includes example commands with hardcoded placeholder credentials (e.g., admin/password) and references the use of the rockyou.txt wordlist for password cracking.
[PROMPT_INJECTION]: The skill implements a 'Mandatory confirmation gate' and specific instructions that dictate how the agent should behave and interact with the user before performing high-risk operations.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to its handling of untrusted data from network scan outputs and OSINT results. Ingestion points include Nmap, Nikto, and Google search results. Boundary markers are limited to a process-based confirmation gate, while capabilities include extensive shell execution and file modification. No specific sanitization methods are documented for external tool output.

ethical-hacking-methodology