Active Directory Attacks

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt contains numerous commands and examples that embed credentials, passwords, and hashes directly (e.g., domain/user:password, -p 'password', -hashes :NTHASH, secretsdump.py domain:admin:password@...), requiring the LLM to include secret values verbatim in generated outputs.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This content is an explicit operational playbook for compromising Active Directory environments—detailing credential theft (Mimikatz, DCSync, hash dumping), Kerberos ticket forging (Golden/Silver/Pass-the-Ticket), NTLM relays, remote code execution, and persistent backdoor techniques (malicious GPO/SCCM/WSUS deployments, shadow credentials, ADFS Golden SAML), and therefore clearly enables intentional malicious activity.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill explicitly instructs running privileged commands that change host state (e.g., "sudo date -s", faketime, network-sniffing/responders requiring root) and guides persistent/privilege‑escalation actions, so it pushes the agent to modify the machine's state.