The Agent Skills Directory

[COMMAND_EXECUTION]: The skill contains a Python script in the 'Timing Oracle' section that utilizes the subprocess.run function to execute the curl binary for performing network requests.
[DATA_EXFILTRATION]: The instructions describe methods to exfiltrate sensitive information, including cloud metadata tokens (AWS, GCP, Azure) and the content of local system files like /etc/passwd, to external out-of-band listeners.
[EXTERNAL_DOWNLOADS]: The skill provides instructions for using external OOB listeners on domains such as interactsh.com, oast.pro, and canarytokens.org, which involves making network requests to non-whitelisted destinations.
[PROMPT_INJECTION]: The skill defines an attack surface where an agent processes untrusted data from URL parameters and remote sources without explicitly defining sanitization or boundary markers, which can lead to indirect prompt injection vulnerabilities.

hunt-ssrf