building-c2-redirector-infrastructure

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). Several URLs point to third-party GitHub repositories (and a non-mainstream project site) that can be used to host or distribute tooling/binaries for C2 (dual-use/malicious) activity, making them potentially suspicious download sources in this context.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This content intentionally documents how to build and operate command-and-control (C2) redirectors and filtering proxies (including examples that proxy implants to a hidden team server), which directly enables backdoor C2 infrastructure and adversary operations.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The runtime workflow in scripts/agent.py actively probes a live redirector over HTTPS by issuing requests.get() calls using user-supplied --domain and --decoy, and it ingests response headers (e.g., Location) and status codes to determine whether traffic is diverted or proxied.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly runs a git clone of https://github.com/threatexpress/cs2modrewrite and later invokes its Python scripts (python3 cs2modrewrite.py / cs2nginx.py) to generate redirector rules, which fetches and executes external code required at runtime.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). This skill explicitly instructs installing packages with sudo, editing system configs under /etc, changing firewall/iptables/sysctl settings, and reloading system services — all actions that modify the host state and require root privileges.