tomcat-manager-deploy

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly instructs using and embedding actual Tomcat credentials (e.g., curl -u 'USER:PASS', base64 Authorization headers) and to read credentials from files, which requires the LLM to include secret values verbatim in commands/outputs, creating an exfiltration risk.

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 1.00). These URLs target Apache Tomcat Manager endpoints (deploy/upload/undeploy), include embedded credentials and an attacker-hosted file reference (ATTACKBOX), and clearly facilitate uploading/executing WAR/JSP payloads—strong indicators of a malicious deployment/execution vector.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This document is a clear, high-risk exploitation playbook: it instructs how to deploy malicious WARs via Tomcat Manager to achieve remote code execution (reverse shells), harvest credentials and configuration files, and persist/cover tracks—demonstrating deliberate offensive/backdoor behavior and data-exfiltration techniques.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill explicitly instructs deploying a malicious WAR, executing remote code, modifying files on the target (webapps, Tomcat configs), and running commands to obtain a reverse shell — all actions that change the target machine's state and enable remote compromise, so it must be flagged.