The Agent Skills Directory

[DATA_EXFILTRATION]: The skill provides explicit commands to exfiltrate sensitive information, including Service Account tokens and private keys, to an external domain (attacker.com). These exfiltration patterns are prevalent across SKILL.md and all referenced files.
[CREDENTIALS_UNSAFE]: The skill instructs the agent to search for and extract private keys from the filesystem and environment variables. It targets highly sensitive paths such as ~/.config/gcloud/application_default_credentials.json and metadata endpoints that provide access tokens.
[PRIVILEGE_ESCALATION]: Extensive documentation is included for escalating IAM privileges. Techniques include creating new service account keys, impersonating higher-privilege service accounts, and deploying compute resources with attached elevated identities to bypass access controls.
[PERSISTENCE]: The skill details methods for maintaining access, such as generating backdoor service account keys, modifying IAM policies to grant access to external attacker accounts, and using VM startup scripts for automated command execution.
[COMMAND_EXECUTION]: The skill frequently uses curl and gcloud to perform administrative and potentially destructive actions. It also uses patterns that pipe network output directly into a python3 interpreter for parsing and execution.
[EXTERNAL_DOWNLOADS]: The skill guides the user to download and run external offensive security tools from repositories such as RhinoSecurityLabs' GCP-IAM-Privilege-Escalation and InGuardians' peirates.
[INDIRECT_PROMPT_INJECTION]: The skill has a significant attack surface for indirect prompt injection because it ingests untrusted data from cloud metadata services, storage buckets, and logs without implementing boundary markers or sanitization.
Ingestion points: Processes data from GCP Metadata services, GCS buckets, BigQuery datasets, and Kubernetes cluster secrets (e.g., references/gke-attack.md).
Boundary markers: None identified in the provided instructions for processing external cloud data.
Capability inventory: High-privilege access to GCP APIs via gcloud/gsutil/bq and the ability to execute network and shell commands.
Sanitization: No sanitization, validation, or filtering of the ingested cloud data is implemented.

gcp-exploit