Active Directory Attacks

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill contains many commands and examples that embed plaintext credentials, passwords, and credential hashes directly (e.g., user:password, -p 'Password123', :NTHASH), which would require the LLM to reproduce secret values verbatim and thus creates a high exfiltration risk.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The documents contain explicit, step‑by‑step offensive instructions (credential theft, DCSync, Kerberos ticket forging, NTLM relay, GPO/SCCM/WSUS backdoor deployment and remote code execution) intended to compromise Active Directory environments and establish persistent access—clear malicious intent and high abuse potential.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill explicitly instructs privileged/local state changes (e.g., "sudo date -s ...") and guides use of powerful tools and actions (Mimikatz, restorepassword, creating machine accounts/persistence) that modify system or domain state and require elevated/sudo privileges.