The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides comprehensive instructions for executing commands through various administrative and remote management protocols, including WinRM (5985), WMI (135), SMB/PSExec (445), and DCOM. It utilizes offensive tools such as Impacket, NetExec (cme), and Mimikatz to perform these actions.
[DATA_EXFILTRATION]: Detailed guidance is provided for accessing and extracting highly sensitive system information, including the Security Account Manager (SAM) database, LSA Secrets (SECURITY hive), and LSASS memory dumps. These sources contain plaintext passwords, NTLM hashes, and Kerberos tickets for local and domain users.
[PRIVILEGE_ESCALATION]: The instructions include techniques for escalating or lateralizing privileges, such as modifying the Windows registry to enable 'Restricted Admin' mode for RDP Pass-the-Hash attacks and performing Kerberos 'Overpass-the-Hash' to upgrade NTLM credentials to Kerberos tickets.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and act upon data from external sources and tool outputs (e.g., scanning results from naabu, credential dumps from mimikatz).
Ingestion points: Tool outputs from network scanners and credential extraction utilities are processed to determine the next lateral movement step.
Boundary markers: The instructions lack explicit boundary markers or sanitization logic to prevent the agent from being influenced by malicious content embedded within the output of targeted systems or tools.
Capability inventory: The skill has extensive command execution capabilities (WinRM, WMI, SMB) and file system access (registry modification, credential file reading).
Sanitization: No sanitization or verification of data received from remote targets is described.

lateral-movement