analyzing-cobalt-strike-beacon-configuration

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The skill's code and instructions explicitly extract and print beacon configuration fields (C2 domains/URIs, public keys, UA strings, etc.) and even embed those values verbatim into generated signatures, so an LLM executing the skill would output potentially sensitive secret values directly.