The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill provides functional webshell payloads for multiple languages including PHP (<?php system($_GET['cmd']); ?>), JSP (<%Runtime.getRuntime().exec(request.getParameter("cmd"));%>), and ASP (<%eval request("cmd")%>).
[COMMAND_EXECUTION]: Instructions guide the agent to execute system-level commands on target environments using uploaded shells (e.g., id, cmd).
[DATA_EXFILTRATION]: The methodology details techniques for unauthorized file reading, specifically using ZIP symbolic link attacks to access sensitive system files like /etc/passwd.
[PRIVILEGE_ESCALATION]: The skill describes methods to bypass filesystem restrictions and security controls, such as path traversal (../) in filenames to write shells to web roots and overriding server configurations using .htaccess or .user.ini to escalate execution permissions.
[DYNAMIC_EXECUTION]: The references/upload-bypass.md file contains Python code snippets designed to programmatically generate malicious files at runtime, including Zip Slip payloads and GIF images with embedded PHP code blocks.
[INDIRECT_PROMPT_INJECTION]:
Ingestion points: The skill is designed to process external target metadata, form structures, and server response headers (identified in SKILL.md) to tailor its exploitation strategy.
Boundary markers: Absent. There are no instructions to the agent to validate or sanitize target data before applying exploit templates.
Capability inventory: Includes remote code execution, arbitrary file writing, filesystem path manipulation, and server configuration overriding.
Sanitization: Absent. The skill focuses on providing functional exploit strings rather than defensive sanitization mechanisms.

file-upload-methodology