orchestrator

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt requires embedding plaintext credentials and secrets verbatim into outputs (engagement/scope.md, agent prompts, start_process/command strings, add_credential/add_vuln calls, etc.), which forces the LLM to handle and emit secret values directly and thus is high-risk.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The orchestrator skill explicitly directs active offensive operations—scanning, vulnerability exploitation, reverse shells and shell stabilization, credential harvesting/testing, AV/EDR evasion, pivoting/tunneling, and file exfiltration—behaviors that enable unauthorized system compromise, backdoors, and data theft.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill's mandatory "CVE verification gate" requires spawning a research agent to fetch public PoC URLs and vulnerability details (see "Step 4 — CVE verification gate" and its research Agent prompt), and the orchestrator also routes to web-discovery agents that enumerate external HTTP/HTTPS targets and vhosts — both explicitly ingest untrusted public web content whose findings directly determine subsequent routing and tool use.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.80). The orchestrator explicitly instructs creating and running local scripts that require sudo (hosts-file update, clock sync), directs process-killing and file writes/chmods, and thus drives modifications to the host system state even though many steps require operator approval.