active-directory-attack

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill repeatedly shows and requires embedding plaintext passwords, API-like secrets, and hashes directly into commands and variables (e.g., -p 'password', -p "$PW", user:password@host, -nthash HASH), which forces any agent following or generating these commands to handle and output secret values verbatim.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This document is a high-risk offensive playbook that explicitly instructs credential theft, domain compromise, persistence/backdoor techniques, and data exfiltration for Active Directory environments.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill explicitly instructs changing the host system time with "sudo date -s" and offers a local wrapper to bypass missing passwordless sudo, which directs the agent to perform privileged/local state changes and circumvent host security controls.