executing-red-team-exercise

CRITICAL E004: Prompt injection detected in skill instructions.

• Potential prompt injection detected (critical risk: 1.00). The skill contains explicit, operational instructions and tooling for conducting offensive cyber operations (phishing, C2 infrastructure, payload/implant development, AMSI/ETW evasion, persistence, lateral movement, and data exfiltration) that could be used to carry out real-world malicious attacks.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The runtime workflow loads ATT&CK technique data by downloading and parsing MITRE’s GitHub-hosted STIX JSON in scripts/agent.py (load_attack_techniques() via requests.get), which means the LLM ingests outsider-authored free text embedded in that file (e.g., names/descriptions) from a third-party community repo.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). This skill explicitly instructs building and deploying C2 infrastructure, creating implants, implementing persistence (scheduled tasks, registry changes), and bypassing security telemetry — all actions that modify system state and enable compromising machines.