The Agent Skills Directory

[COMMAND_EXECUTION]: The skill includes numerous shell commands (using curl) specifically designed to exploit LFI and SSRF vulnerabilities on target Gradio servers.
[DATA_EXFILTRATION]: Instructions and payloads are provided to exfiltrate highly sensitive data, including system configuration files (/etc/passwd, /etc/shadow), user SSH private keys, and environment variables which typically contain API keys and other secrets.
[REMOTE_CODE_EXECUTION]: Multiple Python exploitation scripts are provided within the documentation, intended for the agent to execute in order to perform network-based attacks and data harvesting from targets.
[CREDENTIALS_UNSAFE]: The exploit code and documentation specifically target credential stores, including the .ssh directory and cloud provider metadata endpoints (AWS, GCP, Azure) to steal IAM credentials and tokens.

gradio-exploit