multi-layer-network

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This content is explicit offensive guidance for unauthorized network pivoting and tunneling—providing commands to deploy reverse tunnels, webshells (Neo‑reGeorg), frp/chisel/SSH backdoors and multi‑hop proxies that enable remote code execution, credential theft, lateral movement and data exfiltration—i.e., deliberate malicious behavior.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill directly uses runtime URLs like http://TARGET/tunnel.php (Neo-reGeorg) and http://TARGET/suo5.jsp (suo5) to invoke uploaded webshells that execute remote code to establish HTTP-based tunnels, and those endpoints are a required dependency for the HTTP-only egress workflow.