Privilege Escalation Methods

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill includes commands and examples that embed plaintext passwords and credential hashes directly (e.g., user:password, /rc4:<NTLM_HASH>, net user Administrator Password!@#), which requires the LLM to handle and output secret values verbatim, creating an exfiltration risk.

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 1.00). The URL http://attacker/shell.ps1 is a direct link to a PowerShell script on an untrusted/attacker-controlled host (direct executable/script download from an unknown domain is high risk); https://facebook.com is benign.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This document is an explicit, step-by-step post‑exploitation playbook for gaining root/Administrator, stealing credentials (NTDS.dit, tickets, hashes), establishing persistence, and remotely executing attacker payloads — clearly malicious and usable for unauthorized compromise.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). This skill explicitly teaches and scripts privilege-escalation and persistence techniques (sudo abuse, chmod +s, cron/script injection, scheduled tasks, service/GPO abuse, mimikatz/golden tickets, etc.) that instruct an agent to modify system state, obtain root/administrator access, and bypass security controls.