abusing-dpapi-for-credential-access

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly shows and instructs use of plaintext secrets and hashes on command lines (e.g., /password:, /ntlm:, -p 'Password123!', and inserting decrypted masterkey hex), which requires the LLM/agent to handle and output secret values verbatim — a high exfiltration risk.

---

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). These URLs point to well-known offensive/credential-theft tools (SharpDPAPI, Mimikatz, Impacket, DonPAPI) hosted on GitHub — dual-use software that is commonly used to harvest credentials and therefore represents a high-risk download source.

---

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This content explicitly documents and automates DPAPI credential extraction (including offline decryption with passwords/NTLM hashes, domain backup key retrieval, and mass remote collection), which are deliberate credential-theft and lateral-movement capabilities usable for malicious compromise.

---

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The runtime workflow in scripts/agent.py enumerates and reads outsider-supplied file system paths from --profile (mounted/exfiltrated user profile), then passes the discovered artifact file paths and user-provided secrets (--password/--ntlm/--pvk) to SharpDPAPI/Impacket for decryption.

---

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I scanned all files for literal, high-entropy credentials. Most apparent values are clearly example/placeholders or weak example passwords and are ignored per the rules: e.g., "CorrectHorseBatteryStaple" (illustrative passphrase) and "Password123!" (weak example) are documentation examples and not flagged. Filenames like backupkey.pvk and commands/flags (e.g., /pvk:, /password:) are not secrets by themselves.

One literal value, "cc36cf7a8514893efccd332446158b1a", is a 32-character hex string in a /ntlm: example. That string matches the format and entropy of an NTLM hash (a reusable credential that can be used to decrypt DPAPI master keys) and is not a generic placeholder. Per the secret definition (high-entropy literal value that provides access), I treat this as a real credential and flag it.

All other potential matches were ignored as documentation placeholders or low-security/example passwords.

---

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill explicitly instructs running privileged tooling (e.g., SharpDPAPI machinetriage requiring local admin/SYSTEM), retrieving the domain DPAPI backup key as Domain Admin, and mass-harvesting credentials—actions that require elevated privileges and directly compromise the host/domain state.