The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute numerous shell commands using the fly CLI and curl to interact with and exploit Concourse CI instances. \n- [DATA_EXFILTRATION]: Contains explicit instructions and command templates for exfiltrating environment variables and build artifacts to an external ATTACKER_SERVER (found in references/attack-techniques.md). \n- [PRIVILEGE_ESCALATION]: Provides technical methods for escaping CI containers to gain access to the underlying host, including the use of nsenter, host filesystem mounting, and exploiting privileged container configurations (found in references/attack-techniques.md). \n- [PERSISTENCE]: Includes strategies for maintaining long-term access to a compromised environment, such as creating hidden pipelines with time-based triggers and webhook backdoors. \n- [REMOTE_CODE_EXECUTION]: Outlines procedures for injecting malicious tasks and scripts into Concourse pipelines to achieve code execution on CI workers. \n- [TIME_DELAYED_CONDITIONAL]: Leverages Concourse 'time' resources to schedule recurring execution of malicious payloads, facilitating stealthy callback mechanisms.

concourse-tactics