The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides automated exploitation scripts in references/admin-api-and-ssrf.md and references/konga-and-insomnia.md. These scripts allow the agent to perform unauthorized actions such as creating SSRF endpoints and escalating privileges by directly interacting with management APIs.
[DATA_EXFILTRATION]: The skill includes a dedicated script for performing Server-Side Request Forgery (SSRF) attacks. This script is specifically configured to target and retrieve sensitive data from internal cloud provider metadata services (e.g., AWS, GCP, and Azure metadata endpoints).
[REMOTE_CODE_EXECUTION]: The skill provides documentation and procedures for exploiting remote code execution (CVE-2025-1087) and DLL hijacking (CVE-2025-1353) vulnerabilities. It details how to craft malicious Insomnia project files to trigger execution on a victim's machine.
[PROMPT_INJECTION]: The exploitation and detection scripts in references/admin-api-and-ssrf.md and references/detection-scripts.md ingest untrusted data from target HTTP responses without sanitization. This establishes a surface for indirect prompt injection where a malicious target server could return instructions that influence the agent's behavior.
[COMMAND_EXECUTION]: The references/detection-scripts.md file provides a scanning script that automatically attempts to authenticate to the Konga management interface using default credentials (admin/admin), which could be used for unauthorized access attempts.

kong-exploit