kerberos-ticket-forging

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt instructs the agent to insert actual secret material (krbtgt AES/NTLM keys, service keys/hashes, and plaintext passwords) directly into commands and to report found credentials/tokens, which requires emitting secrets verbatim and therefore is high-risk.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The document is a step-by-step blueprint for forging Kerberos tickets to achieve domain persistence, privilege escalation, credential theft (krbtgt/service keys, DCSync via secretsdump), and remote execution (psexec/wmiexec/WinRM), including OPSEC guidance to evade detection—all clear indicators of deliberate malicious intent and high abuse potential.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The prompt explicitly instructs the agent/operator to perform privileged, state-changing actions (e.g., using Mimikatz/Rubeus/ticketer to inject forged Kerberos tickets and recommends running sudo ntpdate / sudo rdate to change system time), which requests escalation/bypass and modification of the machine's state.