coercing-authentication-with-coercer-petitpotam

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill embeds plaintext credentials (e.g., 'Passw0rd!') directly into command examples, which requires an LLM to handle and potentially reproduce secret values verbatim in outputs (high exfiltration risk).

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 1.00). These URLs include GitHub repositories for offensive tooling (Coercer, PetitPotam, Certipy, Impacket) that are legitimate pentest/attack frameworks and therefore represent high-risk download sources if fetched or executed outside authorized testing.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This repository and scripts explicitly document and orchestrate offensive techniques (Coercer/PetitPotam + NTLM relay/ESC8/RBCD) intended to coerce machine authentication, steal certificates/credentials, and achieve domain compromise.