The Agent Skills Directory

[PERSISTENCE]: The skill implements a persistence mechanism by appending a task to /etc/cron.d/shadow-it-check. This configures a daily execution of a monitoring script as the root user, ensuring the activity continues across system reboots.
[PRIVILEGE_ESCALATION]: Several commands require high-level administrative access, including writing to /usr/local/bin/ and modifying /etc/cron.d/, which typically requires sudo or root privileges. The documentation explicitly notes the requirement for privileged access.
[CREDENTIALS_UNSAFE]: The skill executes aws iam generate-credential-report and aws iam get-credential-report, which produces a detailed CSV file containing sensitive metadata about all IAM users in the account, including the status of their passwords and access keys.
[DATA_EXFILTRATION]: The skill accesses sensitive system log files such as /var/log/dns/query.log and /var/log/squid/access.log to identify user activity. It also includes logic to transmit findings via the mail command to external addresses.
[COMMAND_EXECUTION]: The instructions utilize powerful command-line interfaces (gam, gh, aws) and curl to modify configurations and permissions across Google Workspace, GitHub, Slack, and AWS Organizations.
[DYNAMIC_EXECUTION]: The skill dynamically generates a shell script at runtime by writing code directly to /usr/local/bin/shadow-it-check.sh and subsequently marking it as executable with chmod +x.
[INDIRECT_PROMPT_INJECTION]:
- Ingestion points: The skill ingests untrusted data from external logs (/var/log/dns/query.log, /var/log/squid/access.log) and third-party SaaS API responses (via gam and gh).
- Boundary markers: Absent. The commands process and interpolate data into shell variables and reports without explicit delimiters or warnings to the agent.
- Capability inventory: The skill has extensive capabilities including writing to system directories, modifying cron jobs, managing cloud infrastructure (AWS/Google), and performing network requests via APIs.
- Sanitization: Absent. The shell script and command pipelines use basic text processing utilities like awk and grep which do not sanitize potential injection patterns within log files or API fields.

saas-security-posture