triaging-windows-with-kape

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly documents running kape.exe --sync which pulls Targets/Modules from the KapeFiles GitHub repo (https://github.com/EricZimmerman/KapeFiles) at runtime — those fetched .tkape/.mkape definitions (and referenced EZ Tools binaries at https://ericzimmerman.github.io/) directly control what KAPE collects and which external parsers/binaries are invoked, so remote content can change/drive agent execution.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.70). The prompt explicitly requires and instructs using Administrator privileges (raw volume access, VSS, syncing/updating binaries, and remote deployment via PSExec/EDR) and gives commands that perform system-level collection and modification of state, so it encourages high-privilege operations that can compromise the host if misused.