wireless-security-wifi-pentesting

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill includes plaintext passwords in configuration examples (e.g., wpa_passphrase=password123 and sae_password=testpassword), which requires the LLM to emit secret values verbatim in generated files/commands.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This document contains explicit, actionable instructions for active wireless attacks (deauthentication/DoS, rogue AP/evil twin setup, credential harvesting via bettercap/hostapd-wpe, automated PMKID/handshake capture and cracking) that enable unauthorized access, credential theft, and traffic interception.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill includes a runtime installation step that clones and builds remote code which is then executed (git clone https://github.com/OpenSecurityResearch/hostapd-wpe followed by make and running the built hostapd), so this external URL is a runtime dependency that executes remote code.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.90). The skill includes many privileged (sudo) commands that change system/network state (install packages, stop/start services, alter iptables/sysctl, enable monitor mode, run hostapd/dnsmasq/macchanger, etc.), which pushes the agent/user to modify the host machine and require elevated privileges.