sccm-takeover-relay
Warn
Audited by Socket on Sep 4, 2026
1 alert found:
SecuritySecuritySKILL.md
MEDIUMSecurityMEDIUM
SKILL.md
SUSPICIOUS/HIGH-RISK skill. The install sources are partly verifiable and mostly consistent with the stated tooling, so this is not confirmed malware, but the skill is fundamentally an offensive security workflow for AI agents: it directs coercion, NTLM relay, database-side RBAC modification, remote SSH execution, and privilege escalation in live environments. That footprint is coherent with its purpose yet still dangerous, making it a high-security-risk exploit skill rather than a benign admin/integration skill.
Confidence: 93%Severity: 88%
Audit Metadata