moving-laterally-with-netexec

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill shows and instructs use of plaintext passwords and NT hashes embedded directly in CLI commands (e.g., -p 'Summer2025!' and -H '...'), so an agent following it would need to handle and output secret values verbatim, creating an exfiltration risk.

---

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). These URLs point to GitHub repositories that host dual‑use offensive tooling (NetExec, Impacket, lsassy, BloodHound) which can distribute executables/scripts for credential dumping and lateral movement, making them high‑risk download sources outside an authorized testing context.

---

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This content explicitly documents and automates offensive capabilities — credential dumping, password spraying, lateral movement, remote command execution (including AMSI-bypassed PowerShell) and workspace collection — which are deliberate actions used to steal credentials and compromise remote systems.

---

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I flagged the NT hash literals in SKILL.md because they are high-entropy, literal credential values usable for pass-the-hash authentication (they provide direct access). Specifically:
• Line 74 contains a 32-hex NT hash (13b29964cc2480b4ef454c59562e675c) — this is a usable credential, not a placeholder.
• Line 75 contains an LM:NT pair where the LM side is the known empty-LM marker (aad3b435b51404eeaad3b435b51404ee) but the NT side repeats the same 32-hex NT hash — the combined string is a real credential vector.

I ignored obvious low-entropy example passwords in the doc (e.g., 'Summer2025!', 'Welcome2025!', 'Sql2025!') because they are simple, human-readable examples used for demonstration and do not meet the high-entropy secret definition.

---

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill explicitly instructs bypassing security (e.g., "amsi-bypassed"), executing commands on remote hosts and dumping credentials (SAM/LSA/NTDS), and even includes sudo-based installation steps — all actions that enable compromising system security and altering machine state.