responder

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). This skill explicitly instructs running Responder to capture and review authentication artifacts (e.g., "cat Responder-Session.log" and "Review captured hashes"), which requires accessing and could require outputting sensitive credential values verbatim.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The skill documents and provides explicit commands for active LLMNR/NBT-NS/mDNS poisoning, WPAD attacks, and capturing authentication material—techniques that directly enable credential theft and unauthorized network compromise if misused.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill instructs running Responder against a network interface (including active poisoning and WPAD attacks), actions that modify network state and typically require elevated/root privileges, so it pushes the agent to compromise the host/network.