privesc-linux

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This skill contains explicit, actionable instructions for unauthorized privilege escalation, creation of persistent backdoors (SUID root binaries, adding root users, LD_PRELOAD payloads, cron/service modification), remote/host compromise (container escape, docker socket abuse, chroot) and kernel exploit usage — i.e., deliberate malicious behavior to gain and maintain root access.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 1.00). The SKILL.md's "Automated Enumeration" explicitly tells the user to fetch and execute linpeas.sh from GitHub (curl -L https://github.com/.../linpeas.sh | sh) and also references external public resources like GTFOBins and searchsploit, meaning the agent would ingest and act on untrusted, user-controlled web content that can influence subsequent actions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill explicitly runs a runtime command that downloads and pipes to a shell the LinPEAS script from https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh (curl ... | sh), which executes remote code fetched at runtime and is presented as a required enumeration step.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The prompt explicitly instructs creating/modifying system files (e.g., appending to /etc/passwd, changing systemd ExecStart), creating SUID binaries, using sudo/LD_PRELOAD exploits, and container/host escape techniques—directly guiding actions that compromise the host system state.