performing-credential-access-with-lazagne

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt explicitly instructs extracting plaintext credentials and using them verbatim in commands and outputs (e.g., crackmapexec -u recovered_user -p 'recovered_pass', smbclient domain.local/user:'password'@...), which requires the LLM to handle and emit secrets directly and creates a high exfiltration risk.

---

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). This is the official GitHub repository for LaZagne, a well-known credential-harvesting post‑exploitation tool — hosted on a trusted domain but clearly dual-use/malicious in capability, so downloading or running it is high-risk unless authorized and done in a controlled lab.

---

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This document explicitly instructs and facilitates credential theft and post‑exploitation abuse (transfer via C2, harvesting browser/DPAPI/LSA/Wi‑Fi/Git credentials, exporting/exfiltrating results, and using recovered credentials for lateral movement and privilege escalation), demonstrating clear malicious intent and high risk of abuse.

---

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The required runtime workflow involves executing LaZagne and then parsing its exported JSON output (e.g., lazagne.exe all -oJ / creds.json), where the LLM ingests credential text recovered from the compromised host’s password stores (outsider-authored data: content not authored by the operating user, originating from other users/apps on the target).

---

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill explicitly instructs cloning and installing remote code at runtime via "git clone https://github.com/AlessandroZ/LaZagne.git" (followed by pip install), which fetches and enables execution of external code that the skill depends on.

---

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). This prompt explicitly instructs deploying and executing a credential-dumping tool on targets (including transferring binaries), and directs obtaining elevated (SYSTEM/ADMIN) privileges and accessing protected stores (LSA/DPAPI/SAM/shadow), which clearly modifies and compromises the machine's state.