smb-share-webshell

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill repeatedly instructs embedding plaintext credentials verbatim in commands and code (e.g., smbclient --password='PASSWORD', PowerShell LogonUser with hardcoded "Password", Write("/tmp/...","P@ssw0rd!")), which forces the LLM to handle/output secret values directly and is high-risk.

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 1.00). These URLs are highly suspicious because they point to common webshell filenames (.php, .aspx, .ashx, .jsp) that accept command parameters (cmd, c) and thus allow remote command execution — indicating active backdoors rather than benign downloads.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The document contains explicit, actionable instructions to deploy webshells via SMB into web-accessible directories (PHP/ASPX/JSP), trigger remote code execution, establish reverse shells, perform credential theft and .NET impersonation (LogonUser) to write files as other users — all clear, high-risk backdoor and RCE techniques usable for malicious abuse.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill explicitly directs the agent to write webshell files into web server document roots via SMB, trigger remote code execution, perform .NET impersonation to write files as other users, and establish reverse shells—actions that modify the host state and enable RCE.