covenant

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This content documents a collaborative C2 framework that provisions implants (Grunts), listeners (HTTP/S/SMB), remote code execution (shell, PowerShell, in‑memory assembly execution), file upload/download, and explicit post‑exploitation tooling including credential dumping (Mimikatz) and BloodHound collection (SharpHound), all of which are deliberate backdoor/data‑exfiltration and system‑compromise capabilities.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The command "docker run -it -p 7443:7443 ghcr.io/cobbr/covenant" pulls and runs a remote container image (ghcr.io/cobbr/covenant) at runtime, which executes remote code the skill depends on, so it meets the criteria for a runtime external dependency that executes code.