The Agent Skills Directory

[PROMPT_INJECTION]: The skill utilizes authoritative directives such as "ACTION REQUIRED", "NOW", and "ACT" to enforce specific operational workflows. These instructions command the agent to prioritize these steps immediately upon reading, which can be leveraged to bypass or override standard agent operational constraints.
[DATA_EXFILTRATION]: The instructions guide the agent to locate and extract highly sensitive information, including AWS credentials (~~/.aws/credentials), SSH private keys (~~/.ssh/id_rsa), environment configuration files (.env), and operating system password files (/etc/passwd). It further details the use of tools like Mimikatz to dump credentials from system memory.
[COMMAND_EXECUTION]: The skill contains an extensive collection of shell commands for reconnaissance (e.g., nmap, subfinder), vulnerability exploitation (e.g., sqlmap, nuclei), and lateral movement (e.g., crackmapexec, psexec.py). These commands allow the agent to perform broad offensive operations on a network.
[EXTERNAL_DOWNLOADS]: The skill references the download of various external scripts and binaries, such as linpeas.sh, winPEAS.exe, and GodPotato.exe, for privilege escalation. Examples in the evasion cheatsheet also include the use of certutil to download remote payloads from untrusted sources.
[PRIVILEGE_ESCALATION]: Detailed procedures are provided for gaining administrative or root access on target systems. This includes techniques like DLL hijacking, exploiting unquoted service paths, and using specialized escalation tools like GodPotato for Windows or abusing sudo misconfigurations on Linux.
[PERSISTENCE_MECHANISMS]: The skill outlines several methods for maintaining access to a compromised system, including the creation of cron jobs, the injection of SSH authorized keys, the establishment of shadow accounts, and the use of WMI event subscriptions to trigger malicious code.
[REMOTE_CODE_EXECUTION]: Patterns for establishing remote access and executing code are provided, including the use of C2 frameworks like Cobalt Strike, Sliver, and Havoc. It also highlights the use of LOLBins (Living Off the Land Binaries) like mshta and rundll32 to execute remote payloads while evading detection.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data during reconnaissance (e.g., whatweb technology fingerprinting). 1. Ingestion points: Target discovery outputs in SKILL.md. 2. Boundary markers: Absent. 3. Capability inventory: High (extensive shell command execution and file system access). 4. Sanitization: Absent. This creates a risk where instructions embedded in processed data could trigger unauthorized actions.

attack-chain