The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides numerous command-line templates for executing offensive security tools including crackmapexec (cme), kerbrute, nuclei, and impacket. These commands enable the agent to perform automated authentication spraying and service enumeration against network targets.
[CREDENTIALS_UNSAFE]: Instructions direct the agent to harvest sensitive credentials from various locations, including SSH private keys (~/.ssh/id_rsa), AWS configuration files, NTLM hashes from the SAM database/LSASS memory, and plain-text passwords stored in .env files and shell history.
[PRIVILEGE_ESCALATION]: Detailed guidance is provided for performing Pass-the-Hash (PTH) and Pass-the-Key (PTK) attacks to gain unauthorized administrative access and facilitate lateral movement within a domain environment.
[INDIRECT_PROMPT_INJECTION]: The skill defines a surface for processing untrusted data with high-privilege capabilities.
Ingestion points: External data enters the context via evidence_list and evidence_read calls in SKILL.md.
Boundary markers: None provided to isolate gathered evidence from task instructions.
Capability inventory: The skill provides access to powerful network scanning and authentication tools.
Sanitization: No evidence of input validation or sanitization before interpolating gathered credentials into shell commands.

cred-spray