cobalt-strike

SUSPICIOUS: the skill is internally consistent with its stated purpose, but that purpose is to equip an AI agent with offensive C2 and post-exploitation capabilities, including credential theft, stealth, lateral movement, and remote execution. There is no clear malicious installer or hidden exfiltration beyond examples, so this is not confirmed malware, but it is a high-risk offensive-security skill inappropriate for broad agent deployment.

未发现明确的供应链恶意植入或隐蔽后门，但文档示例包含高风险双重用途功能。上线通知示例会将 Beacon 主机与用户信息发送至外部 Webhook，属于潜在信息泄露；其他示例可生成 Payload、执行命令、读取密码哈希并进行提权和横向移动。应仅在明确授权的隔离环境中使用，并审查或移除外传示例及未受限制的命令执行功能。

This is a readable Cobalt Strike Beacon post-exploitation command reference. It documents highly dangerous offensive actions, including credential theft, surveillance, code injection, privilege escalation, and lateral movement, so unauthorized use presents a high operational security risk. However, the supplied artifact is documentation only and contains no executable code, embedded malware, hardcoded secrets, or direct data-exfiltration implementation. Malware presence in this fragment is unlikely.

该片段是 Cobalt Strike 操作与 Arsenal Kit 选择指南，不包含可直接执行的恶意程序或明确的数据窃取逻辑。其内容涉及 C2、横向移动、提权、凭据获取和检测规避，具有较高的双用途和攻击滥用风险；是否构成恶意行为取决于使用场景。