The Agent Skills Directory

[COMMAND_EXECUTION]: The skill includes numerous shell command examples (PowerShell, Bash, and CMD) designed to simulate Advanced Persistent Threat (APT) behaviors. This includes credential harvesting techniques like LSASS memory dumping, process hollowing, and lateral movement using WinRM. These commands are clearly labeled as simulation templates for red team exercises.
[EXTERNAL_DOWNLOADS]: Provides instructions to download and install security assessment frameworks from official sources. This includes cloning the Atomic Red Team repository from Red Canary and the CALDERA repository from MITRE on GitHub. It also includes instructions for downloading agents from a user-defined server during simulation exercises.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from external threat intelligence sources (e.g., MISP, OpenCTI, AlienVault OTX) and vendor reports. While this is an ingestion surface for untrusted data, it is a standard part of threat intelligence workflows.
Ingestion points: Data from threat intelligence platforms and vendor report repositories specified in Phase 1.2.
Boundary markers: None explicitly defined for external data ingestion.
Capability inventory: The skill provides templates for executing OS commands, PowerShell scripts, and agent software across multiple phases.
Sanitization: No specific sanitization or validation logic is provided for the external intelligence data being processed.

apt-emulation