executing-active-directory-attack-simulation

CRITICAL E004: Prompt injection detected in skill instructions.

• Potential prompt injection detected (critical risk: 1.00). The skill provides explicit, step-by-step offensive instructions and tooling to perform Active Directory compromise (credential extraction, ticket forging, DCSync, lateral movement), which directly enable harmful secret exfiltration and domain takeover.

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly includes and instructs documenting plaintext credentials, example passwords, hashes, and commands embedding user:password pairs, requiring the LLM to handle and output secret values verbatim.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). At runtime, scripts/agent.py ingests outsider-authored free text from the target Active Directory itself by querying LDAP attributes (e.g., servicePrincipalName, userAccountControl, member) that may contain attacker-influenced values, then uses those values in filtering/report generation without selecting a specific item first.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill explicitly instructs running privileged, state-changing offensive actions (psexec, DCSync, LSASS dumps, Mimikatz, forging tickets, granting group membership) that would compromise the host/domain and require bypassing or abusing elevated privileges.