pentest-credentials

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt explicitly instructs including plaintext passwords and hash values verbatim in commands and report outputs (e.g., -p 'Spring2026!', "Welcome1", "Backup2024", example hashes), so the LLM would be required to handle and output secret/credential values directly, creating an exfiltration risk.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This skill contains explicit, actionable instructions and commands for credential theft and account compromise (offline hash cracking, password-spray, credential stuffing, brute-force attacks) along with operational advice to evade detection and lockouts, making it high-risk for malicious misuse.