lateral-movement

This skill is a high-risk offensive security skill for AI agents. Its actual footprint—credential dumping, lateral movement, stealth guidance, remote execution, and exfiltration of authentication material—is fully aligned with adversarial post-compromise operations and is not proportionate for normal developer workflow automation.

该内容不是普通依赖库代码，而是一份明确指导 Windows 凭据窃取、离线破解、凭据外传和横向移动的操作手册。虽然未包含实际恶意程序、固定攻击者基础设施或硬编码秘密，但其描述的命令和流程具有明显的攻击性和双用途滥用风险；在未经授权的环境中使用将导致严重安全影响。

该片段是面向凭据滥用和 Windows 域横向移动的操作指南，而非恶意软件源代码。它不显示自身会自动窃取或外传数据，但明确指导使用 Hash、Kerberos 票据、LSASS 转储工具和远程执行工具进行未授权认证与系统访问。应仅在明确授权的安全测试环境中使用；作为软件供应链代码审查对象，不存在可判定的包内恶意载荷，但内容本身具有较高的攻击性和安全风险。

该片段不是恶意软件代码，而是一份高度可操作的 Windows 远程执行和规避检测技术指南。它展示了凭据/哈希复用、远程命令执行、文件传输、远程注册表修改及 AMSI 绕过等高风险操作。若被未经授权使用，可能导致远程主机接管；但仅凭此文档不能认定其包含恶意载荷或供应链后门。

No malware or executable attack code is present in this fragment; however, the JSON contains highly actionable offensive guidance for lateral movement and credential abuse (explicit method selection/stealth ordering for WinRM/WMI/PSExec, and technique mapping for Pass-the-Hash and Pass-the-Ticket, plus facilitation of SSH key use via chmod guidance). As a supply-chain component for an agent/skill, this materially increases the risk of unauthorized intrusion if misused.

This fragment is a highly weaponizable offensive playbook for Windows lateral movement and credential abuse (including pass-the-ticket via mimikatz) plus pivoted/scoped scanning. It contains no obfuscated payload or embedded malware logic, but its explicit intrusion-enablement nature makes it a strong security red flag in any software supply-chain context.