The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill references and encourages the use of the well-known default Harbor administrative credential admin/Harbor12345 for unauthorized access attempts.
[DATA_EXFILTRATION]: Detailed instructions are provided for configuring Harbor Webhooks and Replication Policies to transmit sensitive container images, audit logs, and environment metadata to external, attacker-controlled servers such as ATTACKER_SERVER or ATTACKER_REGISTRY.
[REMOTE_CODE_EXECUTION]: The skill includes Dockerfile templates designed to perform malicious activities when the resulting container is executed, such as downloading and piping remote scripts directly to a shell (curl ... | sh) and establishing reverse shells to external IPs.
[COMMAND_EXECUTION]: The instructions rely heavily on shell command execution, including tools like curl, docker, skopeo, crane, and jq, to perform reconnaissance and exploit Harbor instances.
[INDIRECT_PROMPT_INJECTION]: The skill presents a surface for indirect injection by ingesting and processing untrusted data from Harbor API responses.
Ingestion points: Data enters the context through API endpoints like /api/v2.0/projects and /api/v2.0/systeminfo described in SKILL.md and references/attack-techniques.md.
Boundary markers: None observed; there are no instructions to the agent to treat external API data as untrusted or to ignore embedded instructions.
Capability inventory: The skill possesses full access to network operations (curl, docker push), file system manipulation (docker save, tar), and subprocess execution.
Sanitization: No evidence of sanitization or strict schema validation is provided for the data retrieved from external registries.

harbor-tactics