The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill provides specific chains to achieve code execution on target systems, leveraging modules like os and random through attribute injection. Evidence: Payloads in references/exploitation-payloads.md such as __init__.__globals__.random._os.system and __init__.__globals__.os.system.
[COMMAND_EXECUTION]: The documentation includes multiple shell commands for executing attacks and interacting with target APIs. Evidence: Use of curl -X POST commands to trigger pollution and the recommendation to use flask-unsign for session forging.
[DATA_EXFILTRATION]: Methods for reading sensitive application configuration and system files are provided. Evidence: Payloads to leak SECRET_KEY and access /etc/passwd by modifying static directory paths or template search paths.
[OBFUSCATION]: The skill teaches techniques to evade security controls using encoding and escape sequences. Evidence: references/pydash-bypass.md details the use of octal encoding (e.g., \137\137class\137\137) in Cookies to bypass WAF filtering.
[PRIVILEGE_ESCALATION]: Techniques for elevating user privileges by corrupting class attributes are documented. Evidence: Instructions to pollute User.is_admin to gain administrative access.

python-prototype-pollution