ad-dacl-abuse

SUSPICIOUS: the skill is internally consistent as a pentest technique, but it equips an AI agent with explicit offensive AD abuse procedures including password resets, ACL rewrites, DCSync, hash dumping, and GPO-based RCE. There is no evidence of covert third-party credential harvesting, so this is not confirmed malware, but it is a high-risk exploit skill.