SSH Penetration Testing

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt contains numerous examples that embed secrets verbatim (literal passwords in code, an ssh public/key string added to authorized_keys, curl commands to fetch id_rsa, and commands that print username:password), so an LLM following it would be instructed to handle and output secret values directly.

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 1.00). High risk: these URLs include direct links to private SSH keys and an archive on an untrusted domain (and a localhost tunnel endpoint that can expose internal services), which are strong indicators of credential theft/exfiltration and could deliver malicious payloads when downloaded.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The content contains explicit, actionable instructions for brute-forcing credentials, harvesting/exfiltrating keys and histories, establishing reverse shells and SSH tunnels for pivoting, and adding persistent backdoor keys—clear patterns of deliberate malicious behavior.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The SKILL.md workflow explicitly instructs fetching and interpreting content from arbitrary public targets — e.g., Phase 5's "curl -s http://target.com/.ssh/id_rsa" and Phase 2 banner-grabbing (nc/telnet, nmap -sV) — which causes the agent/operator to ingest untrusted third-party web/host content that can materially influence subsequent actions.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill contains explicit, actionable instructions to modify system files and persist access (for example appending to /etc/proxychains.conf and adding keys to ~/.ssh/authorized_keys), perform post‑exploitation and reverse shells, and run brute‑force/exploit workflows that can change the machine's state and require elevated privileges.