cred-spray

该技能的 stated purpose 就是实施凭据喷洒、凭据复用和 PTH/PTK，并包含锁定规避与隐蔽枚举方法，属于面向入侵扩张的攻击性 AI 代理技能。虽然未确认存在真实 pre-execution 恶意载荷，但其能力与数据流本身已足以构成高风险、恶意用途明显的技能。

该内容是面向 Active Directory 的凭据攻击和侦察操作指南，明确包含用户枚举、密码喷洒、AS-REP Roasting、离线破解及检测规避方法。它具有较高的滥用风险，但所提供内容不是可执行软件代码，未发现恶意载荷、持久化、反向 shell、环境凭据窃取或网络数据外传实现。应仅在明确授权的安全测试环境中使用。

This fragment contains no runnable malware, but it is security-sensitive configuration designed to elicit and retrieve offensive credential-spraying methodology (password spray / PTH / NTLM) via an LLM and an external tooling harness. In a software supply-chain context, packaging and distributing such a skill/test definition materially increases the potential for automated offensive guidance, even though no attack is executed inside the fragment itself.

This JSON artifact is a high-risk, attack-enabling prompt/evaluation set for credential abuse. While it contains no runtime malware behavior, it explicitly instructs how to plan lockout-avoidant password spraying, how to form crackmapexec SMB Pass-the-Hash commands for a subnet, and how to generate additional password candidates from harvested patterns—capabilities that materially facilitate real-world unauthorized access. Treat as malicious/unsafe content for distribution in a software supply chain context.