mythic-c2

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 1.00). These links point to the Mythic C2 framework (official GitHub orgs and documentation) which hosts source code and installable agents/payloads used for command-and-control and post‑exploitation — a high-risk dual-use distribution source that can be used to deliver malware.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This document is an operational guide for deploying and operating a command-and-control (Mythic) framework—covering agent installation, C2 profile setup, payload construction, callbacks, and post-exploitation tasks (including credential/ file access and lateral movement)—and therefore clearly facilitates deliberate malicious behavior such as backdoors, remote code execution, credential theft, data exfiltration, and system compromise.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill includes runtime installation commands that fetch and then execute remote code from GitHub (e.g., git clone https://github.com/its-a-feature/Mythic and ./mythic-cli install github https://github.com/MythicAgents/Apollo), so these URLs are required runtime dependencies that execute remote code.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The prompt instructs installing and running a C2 server and related components using sudo and system-level scripts (apt installs, sudo make, Docker install scripts, certbot, docker cp), which require elevated privileges and modify system files/environment, so it clearly pushes the agent to change the host state.