red-run-legacy

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt explicitly instructs the orchestrator to include plaintext credentials in agent prompts and command strings (e.g., "Credentials: ", start_process examples like evil-winrm -u user -p pass and psexec.py DOMAIN/user:pass@TARGET), which forces the LLM to handle and emit secret values verbatim.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The skill is high-risk: it explicitly orchestrates offensive actions (credential theft, password spraying, hash cracking, remote code execution/reverse shells, privilege escalation, file exfiltration, AV/EDR evasion, and persistence workflows) and includes instructions to spawn privileged subagents and automate exploitation — behaviors that constitute deliberate malicious/backdoor-capable functionality despite the "authorized testing" framing.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The SKILL.md explicitly routes to web-discovery-agent to crawl and interact with HTTP/HTTPS targets and instructs research-agent to fetch CVE details and "public PoC URLs" (see "Web Discovery (if HTTP/HTTPS found)" and "CVE verification gate (MANDATORY)"/research-agent prompts), which means the agent workflow ingests untrusted public web content that can materially affect routing and tool invocation.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.90). The orchestrator explicitly instructs writing and chmoding persistent files, killing/starting system processes, and directs the operator to run sudo scripts (hosts file update, clock sync), which modify host system files and require elevated privileges, so it should be flagged.