mapping-attack-paths-with-bloodhound-ce

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill includes concrete commands that pass passwords, JWTs, refresh tokens, and an admin secret directly on the command line or in HTTP payloads/headers, which requires an agent to handle or embed secrets verbatim (high exfiltration risk).

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). The list includes a shortened GitHub URL (https://ghst.ly/getbhce) which obscures the real destination and can be used to deliver arbitrary docker-compose or other payloads, making it a suspicious download vector despite the other links pointing to reputable SpecterOps/GitHub resources.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). SKILL.md + scripts/agent.py Step 4 (“Upload … through Administration -> File Ingest, or POST to the API” and the agent’s upload() workflow) ingests user-supplied SharpHound ZIP/AzureHound JSON and later runs Cypher over that ingested content, so outsider-authored free text contained in those uploaded files can be read by the runtime.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly runs curl -L https://ghst.ly/getbhce -o docker-compose.yml and then docker compose up, meaning remote YAML is fetched at runtime and executed to deploy containers (remote code), so this external URL is a required runtime dependency.