The Agent Skills Directory

[COMMAND_EXECUTION]: The methodology extensively uses various command-line tools including nmap, ldapsearch, openssl, hydra, and netexec to perform network scanning and directory enumeration.
[EXTERNAL_DOWNLOADS]: The skill instructs the agent to install the ldapdomaindump package using pip3 and references the use of external scripts such as windapsearch.py.
[DATA_EXFILTRATION]: Instructions include searching for sensitive data within LDAP attributes (e.g., userPassword, description) and reading local configuration files such as /etc/sssd/sssd.conf and /etc/nslcd.conf which may contain plaintext credentials.
[INDIRECT_PROMPT_INJECTION]: The skill presents an attack surface for indirect prompt injection as the agent is instructed to process untrusted data from LDAP query results and Web application responses.
Ingestion points: Data retrieved from LDAP servers, tool outputs, and Web application injection test results.
Boundary markers: Absent; there are no instructions provided to distinguish between data and potentially malicious instructions within the tool outputs.
Capability inventory: High; the agent has access to network tools, credential spraying capabilities, and the ability to modify directory attributes via script execution.
Sanitization: None; the skill does not specify any validation or sanitization of the data ingested from external sources.
[DYNAMIC_EXECUTION]: The skill provides Python templates for using the ldap3 library to programmatically modify LDAP attributes, such as injecting SSH public keys into the directory.

ldap-pentesting