The Agent Skills Directory

[DATA_EXFILTRATION]: The skill instructs the agent to access sensitive internal cloud metadata endpoints (e.g., 169.254.169.254, 100.100.100.200, and metadata.tencentyun.com) to harvest temporary IAM/CAM credentials and private instance information.
[CREDENTIALS_UNSAFE]: Provides procedures to read and configure sensitive files such as ~/.aws/credentials and ~/.cos.yaml with harvested session tokens, enabling broader access to cloud environments.
[COMMAND_EXECUTION]: Outlines the execution of multiple high-privilege shell commands using cloud CLI tools (aws, tccli, coscli) to enumerate storage buckets, retrieve cloud functions, and list account users.
[EXTERNAL_DOWNLOADS]: Fetches the coscli utility from Tencent Cloud's official domain (cosbrowser.cloud.tencent.com) and applies executable permissions to the binary.
[INDIRECT_PROMPT_INJECTION]:
Ingestion points: The skill ingests data from external cloud metadata services (e.g., user-data scripts and security credential responses) which are controlled by the target cloud provider or potentially an attacker.
Boundary markers: No delimiters or specific instructions are provided to distinguish or ignore commands that might be embedded within the ingested metadata responses.
Capability inventory: Includes capabilities for shell command execution, cloud API interaction, and local file system modifications.
Sanitization: There is no evidence of sanitization or validation performed on the metadata output before it is processed or used in subsequent shell commands.

cloud-metadata