mid-engagement-ir-detection

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). This skill instructs logging and reporting of raw "payload" and PoC artifacts (including M365 attempt logs and a locked-accounts file) without requiring redaction, which implies the LLM/agent will handle and may output credentials or sensitive secrets verbatim.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). This document contains high-risk, dual-use offensive guidance for credential-theft techniques (M365 password-spray/ROPC probing), logging of sensitive payloads and retention of locked-account lists which could be abused if used without explicit authorization.