The Agent Skills Directory

[OBFUSCATION]: Pitfall 27 explicitly instructs the agent to use Base64 encoding to hide sensitive data, such as SSH private keys, from built-in LLM safety filters that would otherwise redact the information. This is a direct instruction to circumvent platform security controls.
[REMOTE_CODE_EXECUTION]: The skill provides instructions to download and execute an external CLI binary ('caido-cli') from the 'caido.download' domain.
[EXTERNAL_DOWNLOADS]: Fetches executable archives and installs a system-wide CA certificate from external sources inside the WSL container.
[CREDENTIALS_UNSAFE]: The skill encourages accessing sensitive files like '.bash_history' to harvest passwords and utilizes tools like 'ssh2john' to extract crackable hashes from private keys. It also includes patterns for automating authentication using literal passphrases and sudo passwords.
[DYNAMIC_EXECUTION]: Instructs the agent to dynamically write Python 'pexpect' scripts to a host-mounted workspace and execute them within the container to automate interactive shell prompts.
[PRIVILEGE_ESCALATION]: Includes instructions to create and run containers with the '--privileged' flag, which grants the container extensive capabilities on the host system.
[INDIRECT_PROMPT_INJECTION]: The skill ingests raw, unsanitized output from external tools (nmap, ffuf, nikto) and target file contents (HTML comments, source code), creating a significant attack surface for indirect prompt injection.
Ingestion points: Output from 'curl', 'nmap', 'ffuf', 'nikto', and target file contents referenced in 'SKILL.md'.
Boundary markers: Absent. There are no delimiters or warnings defined for processing untrusted external data.
Capability inventory: The skill utilizes 'wslc exec' for command execution (often as root), 'apt-get' for package management, and maintains write access to the Windows host through mounted volumes.
Sanitization: Absent. No mention of filtering or escaping external content is provided.
[COMMAND_EXECUTION]: Frequently uses 'wslc exec' to run complex and potentially dangerous shell commands inside a persistent container environment.
[PERSISTENCE]: The skill sets up environment-level persistence by modifying '/etc/profile.d/proxy.sh' to ensure proxy settings and CA trust remain active across sessions.

wslc-pentest-workflow