credential-recovery

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly requires reporting and saving cracked plaintext credentials (e.g., in return summaries, evidence files, and update_credential(..., secret="...")), which forces the LLM to handle and output secrets verbatim, creating a high exfiltration risk.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). This skill is a high-risk, dual-use credential-cracking guide: it explicitly instructs how to extract and store cracked credentials (credential theft patterns) and repeatedly directs disabling sandbox protections (dangerouslyDisableSandbox) which enables execution of powerful local tooling and circumvents environment safety — both are clear enablers of abuse if used without strict authorization.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill's runtime prerequisite instructions include "git clone https://github.com/openwall/john.git" and subsequent build steps, which fetch remote code and allow executing it to obtain john-jumbo (a required dependency for *2john extraction tools).

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill explicitly instructs disabling the sandbox for all cracking commands (dangerouslyDisableSandbox: true) and includes commands that require sudo (e.g., sudo apt install ...), which directs the agent to bypass security mechanisms and obtain elevated privileges on the host.