coercing-authentication-with-coercer-petitpotam
Audited by Socket on Aug 6, 2026
2 alerts found:
SecurityAnomalySUSPICIOUS/HIGH-RISK skill. Its purpose and capabilities are internally consistent for red-team use, and the install sources are mostly legitimate, but it explicitly equips an AI agent to execute offensive AD coercion/relay chains leading to domain compromise. This is not confirmed malware, but it is a high-risk exploit skill with meaningful operational danger.
No direct malware is implemented in this Python fragment (no obfuscation, no persistence, no built-in exfiltration). However, it is a dual-use orchestrator that runs offensive authentication coercion tooling and accepts credentials. It increases practical risk by (1) echoing the full command line including passwords to stdout, and (2) executing binaries/scripts resolved from PATH (no integrity validation). Treat as high-risk for misuse and for secret-handling in operational environments; real malicious impact would depend on the external 'coercer' and PetitPotam.py code or on PATH/script substitution.