The Agent Skills Directory

[COMMAND_EXECUTION]: Provides example payloads and templates for executing arbitrary shell commands on target systems by abusing extension functions in various XSLT engines, including PHP's php:function, Java's Runtime:exec, and .NET's msxsl:script blocks.
[DATA_EXFILTRATION]: Documents techniques to access sensitive system files (e.g., /etc/passwd, win.ini) using XML External Entities (XXE) and the XSLT document() function. It also includes patterns for performing Server-Side Request Forgery (SSRF) to exfiltrate data or probe internal networks.
[EXTERNAL_DOWNLOADS]: Describes the use of external network callbacks (e.g., http://attacker.example/ssrf) to verify vulnerabilities through out-of-band (OOB) interactions.
[PROMPT_INJECTION]: The skill identifies a surface for indirect prompt injection where an agent might be manipulated by attacker-influenced XSLT inputs.
Ingestion points: User-influenced input parameters such as xslt, stylesheet, transform, and template (found in SKILL.md).
Boundary markers: No specific delimiters or "ignore instructions" warnings are suggested for handling user-controlled stylesheets.
Capability inventory: The playbook leverages capabilities such as file read/write, network requests, and subprocess execution via XSLT extensions.
Sanitization: No validation or sanitization guidance is included to prevent the agent from executing malicious payloads found in untrusted XML/XSLT data.
[NO_CODE]: The skill is composed entirely of markdown documentation and does not include any executable scripts, configuration files, or compiled binaries.

xslt-injection