cobalt-strike

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt explicitly shows running ./teamserver , instructing secrets to be provided on the command line (and thus likely accepted/output verbatim), which is an insecure credential-handling pattern.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The content documents Cobalt Strike’s Beacon implant and operators’ commands — including remote code execution, in-memory assembly execution, credential dumping (Mimikatz), lateral movement (psexec/winrm), SOCKS proxying/port forwarding, and Malleable C2 for stealth — all explicit backdoor/remote-access and credential-theft capabilities readily usable for data exfiltration and attacker persistence.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill instructs running Cobalt Strike teamserver and Beacon commands (in-memory execution, psexec/winrm lateral movement, mimikatz credential dumping, opening SOCKS/ports) which actively create implants, run privileged actions, modify system/network state, and enable compromise of the host or other machines, so it pushes the agent to change/compromise machine state.