windows-privilege-escalation

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 1.00). These links include attacker-controlled payloads and GitHub repositories that distribute UAC bypass/privilege-escalation tools (UACME, JuicyPotato) which are commonly used to deliver or run malicious code and therefore represent high-risk download sources.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This repository is an explicit offensive Windows privilege-escalation playbook containing step-by-step instructions to obtain SYSTEM, create persistence, execute reverse shells, dump and exfiltrate credential stores, and load malicious drivers—i.e., clearly malicious intent and tooling for abuse.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The CMSTP .inf example in UAC_BYPASS_METHODS.md contains an explicit runtime URL (http://ATTACKER/sct_payload.sct) which CMSTP can fetch and execute as a remote .sct payload, meaning the skill describes using an external resource that would run remote code at runtime.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). This skill explicitly instructs the agent to perform local privilege escalation actions that modify system state (create users, reconfigure services, plant/replace binaries and DLLs, run payloads, dump credentials, and create scheduled tasks as SYSTEM), which directly compromise the host.