The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill provides multiple code templates designed to execute code during package installation or build processes across different package managers. Examples include: an npm PoC using the preinstall hook in package.json to run a Node.js script; a PyPI PoC using setuptools command hooks (install, develop, egg_info) in setup.py; a NuGet PoC using MSBuild <Exec> targets in a .targets file; a Ruby PoC using the extensions hook in a gemspec to run C extension build scripts; and a Go PoC using the init() function to execute code upon module import.
[DATA_EXFILTRATION]: The provided PoC scripts are explicitly designed to collect and transmit environment metadata to external, non-whitelisted domains. The metadata collected includes hostname, username, platform, and current working directory (cwd). Transmission methods include HTTP POST requests and DNS queries (canaries) targeting domains such as your-id.interact.sh and canary.researcher.example.
[COMMAND_EXECUTION]: The skill uses numerous shell commands for reconnaissance and exploitation. Examples include curl for fetching package info and source maps, gh api for mining GitHub repositories for configuration files, and jq/sed/grep for parsing sensitive files like package-lock.json, yarn.lock, and requirements.txt.
[EXTERNAL_DOWNLOADS]: The skill instructions involve downloading external tools and fetching data from various public registries. It recommends installing interactsh-client via go install and performs network requests to well-known registries like npmjs.org, pypi.org, hub.docker.com, and proxy.golang.org to check for namespace availability.
[INDIRECT_PROMPT_INJECTION]: The skill's reconnaissance methodology involves parsing data from untrusted external sources and feeding them into shell commands, creating an attack surface. 1. Ingestion points: lock files (package-lock.json, yarn.lock, Pipfile.lock), JS bundles (app.js, app.js.map), and GitHub search results. 2. Boundary markers: Absent. 3. Capability inventory: Extensive shell execution (curl, gh, jq, grep), and multi-ecosystem code execution (node, python, go). 4. Sanitization: Absent; the skill performs direct parsing and interpolation of external content into commands without validation.

offensive-dependency-confusion