sharphound

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt explicitly shows and instructs passing plaintext credentials (e.g., --ldappassword "password") on the command line, which requires embedding secret values verbatim in commands and is therefore high risk.

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 1.00). Most links point to official BloodHound/Neo4j documentation and GitHub repos, but the presence of a direct HTTP link to an executable (http://ATTACKER/SharpHound.exe) hosted on an attacker-controlled server is a high-risk indicator (direct .exe from an untrusted host/HTTP), commonly used to distribute malware.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This documentation explicitly instructs how to deploy a reconnaissance binary to compromised hosts, collect sensitive Active Directory data (users, ACLs, sessions), steal credentials/kerberos-related artifacts, and exfiltrate results with OPSEC guidance—clearly enabling deliberate unauthorized data collection and domain compromise.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The README shows runtime commands that download and execute a remote binary (e.g., certutil/iwr fetching and then running http://ATTACKER/SharpHound.exe), so the skill depends on an external URL used at runtime that executes remote code.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The prompt explicitly instructs transferring and executing SharpHound.exe on target hosts, writing files to system directories, running persistent/looped collection, and exfiltrating sensitive data (including using credentials), which are direct actions that change and compromise the machine's state.