The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill instructs the agent to install the framework using curl https://sliver.sh/install | sudo bash in SKILL.md, which is a high-risk piped execution pattern from an external source.
[PRIVILEGE_ESCALATION]: The skill uses sudo for installation and provides commands like getsystem and impersonate in references/post-exploitation.md to escalate privileges to administrative or SYSTEM levels.
[EXTERNAL_DOWNLOADS]: The armory install command in SKILL.md and references/post-exploitation.md downloads and installs third-party extensions and BOFs (Beacon Object Files) from external repositories.
[DATA_EXFILTRATION]: The skill includes instructions for sensitive data harvesting using tools like procdump, nanodump, mimikatz, and rubeus as documented in references/post-exploitation.md, as well as standard download commands for remote files.
[DYNAMIC_EXECUTION]: The framework supports in-memory execution of .NET assemblies (execute-assembly) and shellcode (execute-shellcode) in references/post-exploitation.md, bypassing traditional file-based detection.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a significant attack surface by ingesting untrusted data from the target environment.
Ingestion points: Commands like cat, ls, and ps (in references/post-exploitation.md) read data from the external target system.
Boundary markers: There are no markers or instructions to treat external data as untrusted.
Capability inventory: The skill has broad capabilities including execute, shell, migrate, and upload (in references/post-exploitation.md).
Sanitization: No sanitization or filtering of external input is implemented.
[TIME_DELAYED_CONDITIONAL]: Implant generation in references/implant-generation.md supports conditional execution flags such as --limit-datetime, --limit-domainjoined, and --limit-hostname, which trigger or suppress behavior based on environment state.
[PERSISTENCE]: The skill describes methods for maintaining access, including process migration (migrate) and the generation of Windows Services (generate --format service) in references/implant-generation.md and references/post-exploitation.md.
[COMMAND_EXECUTION]: Automates C2 server interaction using tmux send-keys to execute arbitrary console commands as shown in SKILL.md.

sliver-c2