exploiting-adcs-with-certipy

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill embeds plaintext credentials and NT hashes directly into example commands (e.g., -p 'Passw0rd!', -hashes ':fc52…'), which requires the LLM to output secret values verbatim and therefore poses an exfiltration risk.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This content is intentionally offensive: it provides step‑by‑step AD CS exploitation techniques (ESC1–ESC16) that enable credential theft, forging/issuing certificates, NTLM relay, and remote domain compromise (TGT/NT hash recovery and DC certificate acquisition).

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The runtime workflow executes certipy find -json ... and then parses attacker/target-derived JSON (scripts/agent.py loads *Certipy.json from disk and extract_findings() walks fields like "[!] Vulnerabilities" and template/CA names), so text originating from the AD CS environment can flow unfiltered into the assistant logic.

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I searched the skill content for high-entropy literal credentials. Most obvious values (e.g., "Passw0rd!", "attacker@corp.local", "pw", ":", truncated "fc525c...") are documentation examples or low-entropy placeholders and are ignored.

However, SKILL.md contains a full 32-hex string ":fc525c9683e8fe067095ba2ddc971889" used with the -hashes flag. This is a high-entropy NT hash format and is a direct, literal credential that could be used for pass-the-hash authentication, so it meets the definition of a secret. Other examples/placeholder markers in the docs (e.g., ":", truncated hashes, example passwords) were not flagged per the ignore rules.