windows-privilege-escalation

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly instructs harvesting and outputting credentials (e.g., "Credential Dump", registry auto-logon showing DefaultPassword, example password P@ssw0rd123, base64-decoded passwords) and contains commands that embed secrets verbatim (psexec/runas with -p, netsh wlan show profile key=clear), which requires the LLM to handle and reproduce secret values directly.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The document provides explicit, actionable techniques for credential harvesting, unauthorized data access, remote code execution (reverse shells, service binary replacement, MSI payloads), token impersonation, kernel exploits and persistence that can be directly abused to backdoor and fully compromise Windows systems despite a stated "authorized use" disclaimer.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). This skill explicitly instructs the agent on techniques to obtain and use Administrator/SYSTEM privileges (service binary modification, SAM/SYSTEM dumping, kernel exploits, AlwaysInstallElevated, token impersonation, etc.), including commands that modify system services and files and execute privileged payloads, so it directly pushes compromising the host state.