The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill contains patterns that pipe the output of remote network requests directly into a Python interpreter for processing or formatting. If the target endpoint is malicious, this allows for potential code execution in the agent's environment.
Evidence in SKILL.md: curl -s "http://$TARGET:10255/pods" | python3 -m json.tool (Phase 3)
Evidence in SKILL.md: curl -s "http://$TARGET:2379/v2/keys/?recursive=true" | python3 -m json.tool (Phase 5)
Evidence in SKILL.md: curl ... | python3 -c 'import sys,json;d=json.load(sys.stdin);print(len(d.get("items",[])),"secrets")' (Phase 2)
[DATA_EXFILTRATION]: The skill facilitates the extraction of sensitive secrets, tokens, and infrastructure credentials.
Evidence: Commands to read service account tokens from /var/run/secrets/kubernetes.io/serviceaccount/token.
Evidence: Probes for sensitive cloud metadata and IAM credentials via 169.254.169.254 (AWS, Azure) and metadata.google.internal (GCP).
Evidence: Procedures for dumping plaintext secrets from etcd and Kubernetes API servers.
[INDIRECT_PROMPT_INJECTION]: The skill ingests and processes data from untrusted internal and external network services, creating a vulnerability surface for indirect prompt injection.
Ingestion points: Data from Kubelet (10250/10255), etcd (2379), and API server (6443) endpoints.
Boundary markers: The skill relies on a manual user confirmation gate but lacks technical delimiters to separate untrusted data from the agent context during processing.
Capability inventory: Capabilities include network requests (curl), file system access, and command execution (python3, nmap, docker).
Sanitization: No sanitization of the retrieved JSON data or command output is performed before it is handled by the agent.
[COMMAND_EXECUTION]: Provides instructions for executing arbitrary commands via container management APIs.
Evidence: Templates for executing commands (cmd=id) against the Kubelet /run endpoint.
Evidence: Instructions for creating privileged Docker containers with host root filesystem mounts.

hunt-k8s