pentest-attack-patterns

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). This list mixes legitimate security reference sites with multiple high-risk entries—attacker-hosted direct links to scripts/executables (e.g., attacker.com/*, ATTACKER_IP/shell.exe), malicious DTDs, and SSRF/metadata endpoints and alternate loopback encodings—so overall it represents a suspicious set of download/attack vectors that could be used to distribute malware.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The document is an explicit offensive toolkit containing exploit payloads (RCE, SQLi, LFI, XXE), reverse shells, credential/secret theft and exfiltration techniques, persistence and privilege-escalation methods—clearly intended to facilitate unauthorized compromise.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The prompt contains explicit, actionable commands and guidance for privilege escalation and modifying system files (e.g., overwriting /etc/passwd, writing to /proc/sys, cron manipulation, creating reverse shells) which require or attempt to obtain elevated privileges and would compromise the host state.