post-exploit

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The content is a post-exploitation playbook that explicitly documents techniques for credential theft (LSASS, /etc/shadow, cloud metadata, keys), privilege escalation, persistence/backdoor installation (cron, systemd, services, IAM keys), lateral movement, process injection and evasion (AMSI bypass, timestomping, disabling logging), and other offensive behaviors—features that directly enable deliberate system compromise and sustained unauthorized access.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill explicitly instructs and normalizes actions that change machine state—privilege escalation probes, creating persistence (systemd units, cron, authorized_keys), modifying services/configs, and creating IAM/users/keys—which encourage sudo-level and stateful modifications.