network-netcat

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The document provides explicit, actionable instructions for reverse and bind shells, remote code execution (including eval/iex patterns), multi-stage payload delivery, data exfiltration, pivoting/relay techniques, and persistence mechanisms (systemd/cron/schtasks), all of which are high-risk backdoor and exfiltration techniques usable for malicious abuse.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). I flagged the CI workflow line that runs curl -s https://raw.githubusercontent.com/aquasecurity/tfsec/master/scripts/install_linux.sh | bash because it fetches and immediately executes remote code at runtime (the workflow also relies on third-party GitHub Actions such as gitleaks/gitleaks-action@v2 and aquasecurity/trivy-action@master which pull and run remote code during CI), satisfying the criteria for a runtime external dependency that executes remote code.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). This skill explicitly instructs creating systemd service files, cron entries, Windows scheduled tasks, running systemctl/crontab and using sudo to install packages, and establishing persistent reverse/bind shells and backdoors — all actions that modify system state and require elevated privileges.