adcs-persistence

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly requires returning "new credentials or tokens found" and contains many examples that embed plaintext passwords/PFX passphrases in commands (e.g., -password 'Pass', --CaCertPassword 'BackupPass'), so the agent would need to handle and potentially output secret values verbatim.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The document is explicitly malicious/offensive in intent: it provides step-by-step AD CS abuse and persistence techniques (golden certificates, forged cert authentication, altSecIdentities mapping, ESC9/10, certificate theft via Mimikatz/DPAPI, and related lateral-movement/persistence workflows) that enable credential theft, long-term backdoors, and full domain compromise.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill explicitly instructs privileged, state-modifying and security-bypassing actions—e.g., backing up CA private keys, patching CAPI/CNG with Mimikatz, changing DC registry values, and modifying AD attributes (altSecurityIdentities) to establish persistence—which directly compromise the host/domain state.