linux-lateral-movement

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly instructs listing, dumping, and reusing credentials (e.g., cat /etc/shadow, dumping /proc/*/environ, grepping env for tokens, printing private keys, and embedding passwords in commands), which requires the agent/LLM to handle and potentially output secret values verbatim.

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 1.00). This GitHub repository links to a tool that performs ptrace-based sudo token hijacking from an individual account (nongiach) — a likely malicious/dual-use exploit distributed from an untrusted/unknown source and therefore suspicious to download or execute.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This document is an explicit offensive playbook with step-by-step instructions for unauthorized lateral movement, credential theft, persistence, and remote access — clearly malicious and high-risk.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). This skill explicitly instructs the agent to perform destructive and privileged actions on the host (SSH agent hijacking, reading/writing other users' secrets, ptrace-based sudo hijack, injecting authorized_keys, creating/writing systemd unit files, making SUID binaries), which would modify and compromise the machine's state.