network-attack

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt explicitly embeds credentials and secrets into command-line examples (e.g., -p $PASS, $DOMAIN/$USER:$PASS, -nthash $KRBTGT_HASH), which requires the agent to supply or output actual passwords/hashes/tokens verbatim in generated commands—creating high exfiltration risk.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This content is an explicit offensive operations playbook—providing concrete commands and techniques for credential harvesting (Responder, NTLM relays, secretsdump, Kerberoasting), remote code execution and backdoors (reverse tunnels, chisel/ligolo, psexec, wmiexec, ntlmrelayx shells), privilege escalation and persistence (Golden/Silver tickets, RBCD, ADCS abuse), and traffic interception (ARP/DNS spoofing, evil twin)—clearly enabling deliberate malicious abuse.