The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The command 'python manage.py print_settings' is used to display Django project settings. Django settings frequently contain highly sensitive information such as the 'SECRET_KEY', database credentials ('DATABASES'), email server passwords, and third-party API keys. The skill explicitly provides examples for wildcard searches like 'DATABASE*' and 'AUTH*', which are likely to reveal credentials.
[DATA_EXFILTRATION]: By exposing all project settings and URL routes, the skill facilitates the collection of sensitive architectural and configuration data that could be used for further exploitation.
[COMMAND_EXECUTION]: The skill includes the 'python manage.py runscript <script_name>' command, which allows the execution of arbitrary Python scripts located in the 'scripts/' directory within the Django context. This provides a direct path for executing code on the system. Additionally, 'shell_plus' and 'runserver_plus' with the Werkzeug debugger provide environments for arbitrary code execution.

django-extensions