linux-pentester-notes

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). Most of the links are well-known pentesting resources (GTFOBins, HackTricks, PayloadsAllTheThings, PEASS-ng and related GitHub repos) and are generally low-risk references, but the list also contains direct script/executable download patterns and clearly untrusted entries (non‑TLS/placeholder links and an attacker-hosted payload URL) that are high-risk for malware distribution, so the overall set should be treated as potentially dangerous.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This repository contains numerous explicit, high-risk malicious patterns—reverse shells, remote command execution/exec/eval-like payloads, persistent backdoors (cron jobs, new users, SSH key injection), data exfiltration commands, credential/the-password manipulation, and simple obfuscation (base64) —all of which enable unauthorized system compromise and data theft (dual-use for pentesting but readily abusable).

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill includes a runtime command that downloads and immediately executes remote code via "curl -L https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh | sh", which is a high-risk external dependency used at runtime.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill contains explicit, actionable commands for gaining access, privilege escalation, creating user accounts, adding SSH keys, installing persistent backdoors, and modifying sensitive system files/logs—directly instructing changes to the host state and bypassing security controls.