Windows Privilege Escalation

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill instructs harvesting and reporting plaintext credentials and demonstrates embedding passwords and hashes directly in commands and outputs (e.g., registry DefaultPassword, psexec -p, runas, credential dumps), which requires the LLM to handle and potentially emit secret values verbatim.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This content explicitly instructs on credential theft, privilege escalation, remote code execution, creation of reverse shells/backdoors, and evasion techniques—clear guidance for intentional malicious compromise and persistence.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). This skill explicitly instructs the agent to perform Windows privilege escalation techniques that modify system files and services, deploy and execute payloads, dump credentials, and change system configuration — all actions that directly compromise and change the host machine's state.