The Agent Skills Directory

[DATA_EXFILTRATION]: The skill provides detailed instructions and XML payloads for exfiltrating sensitive system files (such as /etc/passwd, /etc/shadow, and cloud metadata credentials) to external attacker-controlled servers. It details how to use Out-of-Band (OOB) techniques via HTTP and FTP to bypass constraints and capture multi-line data.
[COMMAND_EXECUTION]: The methodology guides the user to execute local command-line tools to facilitate exploitation. This includes setting up network listeners with netcat (nc) and Python's HTTP server (python3 -m http.server), as well as utilizing archive utilities (zip, unzip) to manually modify Office documents for DOCX-based XXE attacks.
[INDIRECT_PROMPT_INJECTION]: The skill provides an attack surface for indirect prompt injection by instructing the agent on how to construct and send malicious XML payloads to external systems. If an agent uses these methods to process untrusted data or interact with external APIs, it could be coerced into performing unauthorized data access or network requests.
Ingestion points: The methodology identifies XML inputs, SOAP envelopes, SVG images, and Office documents (DOCX/XLSX) as primary vectors for untrusted data ingestion in SKILL.md and references/xxe-exploitation.md.
Boundary markers: No specific delimiters or safety instructions are provided to the agent to distinguish between its own logic and the malicious payloads it generates.
Capability inventory: The skill documents capabilities for arbitrary local file system reading and SSRF-style network requests through vulnerable XML external entity resolution.
Sanitization: The instructions focus on exploiting systems and do not include guidance for the agent to sanitize or validate the malicious XML content it generates.

xxe-injection-methodology