ad-persistence

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt both includes explicit secret examples (e.g., BackupPass123!, CertPass!, "mimikatz" skeleton password) and instructs the agent to record and report persistence credentials (cert PFX, SAML key, skeleton password, captured tokens), which requires the LLM to handle and potentially output secret values verbatim.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This document is explicitly malicious: it provides step-by-step instructions to create persistent, stealthy backdoors in Active Directory (CA private-key extraction and forged certificates, DCShadow object manipulation, LSASS skeleton key injection, custom SSP credential harvesting, ADFS Golden SAML forging, SIDHistory/ACL backdoors, kernel driver installs, and other techniques enabling credential theft, remote takeover, and undetectable long-term access) and is suitable for abuse outside authorized testing.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). This skill explicitly instructs privileged, state-altering operations (LSASS injection, copying DLLs to C:\Windows\System32, registry modifications to LSA Security Packages, DCShadow modifications, forging CA keys/certificates, ACL backdoors and granting remote access) that create persistent backdoors and modify system state, which compromise the host.