The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides detailed instructions for executing arbitrary commands on remote cloud systems and within containers.
Evidence in reference/scenarios/aws/recon-and-iam-privesc.md: Use of aws ssm send-command to run shell scripts on managed EC2 instances.
Evidence in reference/scenarios/azure/recon-and-storage.md: Use of az vm run-command invoke to execute commands as root or SYSTEM on Azure Virtual Machines.
Evidence in reference/scenarios/kubernetes/recon-and-rbac.md: Instructions for using kubectl exec and interacting with the kubelet API (port 10250) to achieve remote command execution in pods.
[DATA_EXFILTRATION]: Multiple techniques for exfiltrating sensitive data from cloud storage and databases are documented.
Evidence in reference/scenarios/aws/recon-and-iam-privesc.md: Commands for sharing EBS and RDS snapshots with external AWS accounts and setting up cross-account S3 bucket replication.
Evidence in reference/scenarios/aws/recon-and-iam-privesc.md: Generation of S3 presigned URLs to allow unauthorized access to private objects.
Evidence in reference/scenarios/aws/moto-mock-aws-quirks.md: Methods for exfiltrating environment variables (like AWS_SECRET_ACCESS_KEY) by triggering and reflecting error messages.
[PRIVILEGE_ESCALATION]: Extensive guidance is provided for escalating privileges across all major cloud providers and Kubernetes.
Evidence in reference/scenarios/aws/recon-and-iam-privesc.md: Procedures for attaching administrator policies to the current user and creating new access keys for existing admin accounts.
Evidence in reference/scenarios/gcp/recon-and-iam.md: Instructions for service account impersonation using actAs permissions and key creation.
Evidence in reference/scenarios/kubernetes/recon-and-rbac.md: Strategies for pivoting from limited service account tokens to cluster-admin privileges by harvesting tokens from different namespaces.
[CREDENTIALS_UNSAFE]: The skill promotes the discovery and use of hardcoded credentials and configuration files.
Evidence in reference/scenarios/aws/recon-and-iam-privesc.md and reference/scenarios/azure/recon-and-storage.md: Instructions to search for ~/.aws/credentials, ~/.azure/msal_token_cache.json, and credentials in environment variables.
Evidence in reference/scenarios/aws/minio-self-hosted-s3.md and reference/scenarios/aws/recon-and-iam-privesc.md: Use of default credentials like minioadmin:minioadmin and test:test for LocalStack environments.
[EXTERNAL_DOWNLOADS]: The skill instructs the user to download and install numerous security tools from external sources.
Evidence in reference/scenarios/aws/recon-and-iam-privesc.md: Commands to git clone the Prowler and Pacu repositories.
Evidence in reference/scenarios/kubernetes/recon-and-rbac.md: Instructions to install kube-hunter and run kube-bench using external Docker images.
[PERSISTENCE]: Instructions for establishing persistence in cloud environments are included.
Evidence in reference/scenarios/gcp/recon-and-iam.md: Method for injecting a startup-script into Google Compute Engine instance metadata to maintain access after a reset.
[DYNAMIC_EXECUTION]: The skill describes techniques for bypassing security controls using dynamic code execution.
Evidence in reference/scenarios/aws/moto-mock-aws-quirks.md: Documentation of a Lambda sandbox escape using Python class hierarchy to reach os.popen() through exec() with a restricted namespace.
[INDIRECT_PROMPT_INJECTION]: The skill has a significant attack surface for indirect prompt injection due to its handling of untrusted cloud data alongside powerful execution tools.
Ingestion points: The skill frequently retrieves data from cloud APIs, metadata services, and container logs (e.g., aws s3 ls, gcloud projects list, kubectl get pods).
Boundary markers: No explicit boundaries or instructions to ignore potential malicious content in cloud data are present.
Capability inventory: High-impact capabilities including remote command execution, file system access, and network operations are documented throughout the scenario files.
Sanitization: There is no evidence of sanitization or strict schema validation for the data ingested from cloud environments before it is used in subsequent operations.

cloud-containers