ajp-ghostcat

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly instructs the agent to read and save file contents that may contain credentials, report "new credentials or tokens found" in its summary, and even pass secrets to tools (e.g., ajpShooter --ajp_secret or curl -u 'tomcat:s3cret'), which requires the LLM to handle and output secret values verbatim.

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 1.00). Highly suspicious — the URLs target local/proxy endpoints, attacker-controlled hosts (ATTACKBOX/TARGET/127.0.0.1:8888) and Tomcat manager/upload paths used to deploy WARs/webshells and execute commands, which is a common malware distribution/exploitation workflow (github.com by itself is benign but does not mitigate the other malicious indicators).

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This skill contains explicit, high‑risk exploitation instructions (Ghostcat AJP file reads, credential harvesting from config files, JSP/webshell upload and WAR reverse‑shell deployment, AJP proxy bypass) that enable deliberate data exfiltration, remote code execution, and persistent backdoor access.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill explicitly instructs running sudo commands and modifying system configuration (e.g., sudo apt install, copying files into /etc/apache2 and restarting Apache) and guides deploying webshell WARs and executing remote commands, which directs privileged state changes on the host and target.