poshc2

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 1.00). The URL is a direct raw GitHub link to an Install.sh for PoshC2—a known command-and-control/post‑exploitation framework—meaning it is a runnable shell script (curl|bash pattern) that can deploy powerful offensive tooling and therefore represents a high-risk download source.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This skill describes PoshC2, a full-featured command-and-control/post‑exploitation framework with proxy-aware beacons, remote implants, built-in credential theft (e.g., Mimikatz), shellcode injection, remote command execution, privilege escalation and lateral movement modules, and even a remote install via curl|bash — all of which are explicit backdoor and data-exfiltration capabilities intended for malicious or offensive use.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The Quick Start contains a runtime command that downloads and immediately executes external code—"curl -sSL https://raw.githubusercontent.com/nettitude/PoshC2/master/Install.sh | bash"—which directly executes remote content and therefore is a high-risk external dependency.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill instructs installation of a C2 framework and includes commands that perform privilege escalation, inject shellcode, run Mimikatz, and execute arbitrary system commands—actions that explicitly modify and compromise the host state.