auth-coercion-relay

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt repeatedly instructs embedding plaintext credentials, passwords, and captured hashes directly into commands and handoff outputs (e.g., -u 'DOMAIN\user' -p 'password', direct hash/cert strings, and shows examples with real-looking API/password values), requiring the LLM to handle and emit secret values verbatim.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This document is a high-risk offensive playbook that intentionally instructs how to coerce hosts to authenticate to attacker-controlled listeners, capture and exfiltrate NTLM/Kerberos credentials and hashes, perform NTLM/Kerberos relay for remote code execution and AD compromise (machine account creation, RBCD, AD CS abuse), and establish interactive/persistent access—i.e., explicit credential theft, backdoor/RCE techniques, and privilege-escalation workflows.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill explicitly instructs at runtime to clone and run code from the krbrelayx GitHub repository (e.g., git clone https://github.com/dirkjanm/krbrelayx.git and python3 /tmp/krbrelayx/dnstool.py), which fetches and executes remote code the skill relies on to perform DNS injection, so this external URL directly controls executed code.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill explicitly instructs the agent/operator to run privileged/root-only tools and commands (sudo ntlmrelayx.py, sudo responder/krbrelayx/mitm6, systemctl stop smbd, start_process(privileged:true), etc.) and to perform actions that modify system state (binding raw sockets, stopping services, and creating machine accounts via relay), which pushes the agent to obtain or require sudo and change the host state.