pywinrm

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt includes multiple plaintext credentials and example code/CLI snippets that embed usernames and passwords directly (e.g., in winrm.Session auth and one-liners), which requires the LLM to handle and could lead to verbatim secret output/exfiltration.

---

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This skill provides full arbitrary remote command execution and administrative control over multiple Windows servers and explicitly embeds plaintext Administrator credentials and target IPs (and includes mechanisms to create persistent scheduled tasks and modify AD/registry), which strongly indicates high potential for deliberate abuse or unauthorized access.

---

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The skill’s runtime path executes PowerShell on a remote Windows host via PyWinRM (session.run_ps(...)), and the remote host’s command output (including event log Message, service DisplayName, file contents, etc.) is decoded as readable text and then inserted into the agent context (e.g., stdout/stderr strings returned to the caller/LLM).

---

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I scanned the entire skill documentation for literal credentials. I flagged only values that are embedded, tied to an Administrator account and look like real, high-entropy passwords. Specifically:
• Flagged:
• &@RSp14muPii*SdILEISHr&BqEu6;j2t (listed as the Password for Administrator on 44.197.31.152)
• hcDfrOjKrvK9&;;CH1N.BxH@)AglPN2Dw (listed as the Password for Administrator on 52.3.242.251)

These are long, random-looking strings (high entropy) and are directly present in the Known Windows Servers table with usernames and IPs — constituting usable credentials.

• Ignored (not flagged) and why:
• data_21ctl@123 — predictable/simple pattern; low entropy (likely example/test password).
• @@Igbosere186@@ — contains a name and numeric pattern; not high-entropy/random-looking.
• P@ssw0rd, PASS, PASSWORD, PASS1/PASS2/PASS3, and other obvious placeholders — documentation/example values or placeholders (explicitly allowed to ignore).
• Environment variable names and examples (WINRM_PASSWORD, WINRM_PASS_1, etc.) — these are names/placeholders, not values.
• No API keys, private key PEM blocks, or truncated/redacted markers like REDACTED_SECRET_ were found.

No private keys or API tokens were found elsewhere in the files.

---

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). This skill explicitly instructs and provides code to perform privileged, state-changing operations (create AD users, modify services, registry, firewall, scheduled tasks, enable WinRM, etc.) which enable remote modification of system state and require elevated privileges, so it should be flagged as high-risk.