red-run-ctf

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt explicitly instructs the agent to include plaintext secrets, cracked passwords/hashes, and flag contents verbatim in structured messages/commands (e.g., state-mgr "[update-cred] ... secret=" and "[add-vuln] ... details="""), which forces the LLM to handle and output secret values directly and creates exfiltration risk.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This skill is an offensive penetration-testing orchestrator that explicitly instructs and automates remote code execution (reverse shells/C2), credential theft and reuse (password spraying, hash cracking), pivot/tunnel setup, AV/EDR bypass, source-code retrieval, and system modifications — capabilities that constitute clear backdoor/compromise and high-risk abuse patterns despite the "operator approval" framing.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The SKILL.md explicitly requires spawning a "research" teammate for mandatory CVE/PoC verification and states "Research sends: payload format, encoding gotchas, working injection syntax, public PoC references" (see "VERSIONED SOFTWARE PoC LOOKUP" / "CVE VERIFICATION GATE" in Decision Logic), which clearly instructs the agent to fetch and interpret public third‑party PoC content that can materially change technique execution.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.90). The orchestrator instructs creating and running scripts that require sudo (hosts-file update, clock-sync) and performs destructive file operations (rm -rf, cp, chmod) which modify the host system state and can change privileged system files, so it actively pushes changes that compromise the machine state.