The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill explicitly instructs the agent to search for database credentials within debug logs. Specifically, it uses grep to search for DB_PASSWORD, DB_USER, and DB_NAME in the /wp-content/debug.log file.
[DATA_EXFILTRATION]: The skill targets the discovery and extraction of PII (Personally Identifiable Information). It instructs the agent to identify and download CSV, XLSX, and PDF files from WordPress upload directories that likely contain customer leads (names, addresses, phone numbers). It also uses regex to extract email addresses from logs.
[COMMAND_EXECUTION]: The skill relies heavily on shell command execution, using curl, grep, and python3 to interact with external targets. It interpolates target domains directly into these commands, which could lead to command injection if the $TARGET variable is not properly sanitized.
[REMOTE_CODE_EXECUTION]: The 'Bypass Techniques' section provides instructions for achieving remote code execution on target servers, such as testing PHP shells disguised as PDF files and attempting to upload webshells to insurance document upload endpoints.
[REMOTE_CODE_EXECUTION]: An automated scanner flagged the pattern of piping curl output directly to python3 for subdomain discovery. While the embedded script currently focuses on parsing JSON data from crt.sh, this execution pattern remains a high-risk vector if the remote source is compromised.

recon-roofing