The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides comprehensive shell command injection payloads including techniques to bypass space and keyword filters using environment variables and string obfuscation.
[REMOTE_CODE_EXECUTION]: Detailed documentation of Remote Code Execution payloads for multiple template engines (Jinja2, Twig, Freemarker, ERB, etc.) and Node.js environments.
[DATA_EXFILTRATION]: Contains SSRF and XXE payloads specifically designed to exfiltrate sensitive cloud metadata and local system files to attacker-controlled DNS/HTTP endpoints.
[CREDENTIALS_UNSAFE]: References and provides methods to access sensitive system files and directories, such as /etc/passwd, ~/.aws/credentials, .env, and private configuration files through path traversal and wordlists.
[OBFUSCATION]: Employs hex-encoded commands (e.g., \x63\x61\x74 for cat) and non-standard URL representations (decimal, octal, and hex IP addresses) to demonstrate and utilize security filter bypasses.
[DYNAMIC_EXECUTION]: Documents the use of dangerous sinks such as eval(), setTimeout(), and new Function() for executing dynamically generated content in web environments.

security-arsenal