ntlm-relay-attack

该技能不是隐藏式窃密器，但它明确将 AI 代理武器化为内网渗透与域提权执行器。能力与声明一致，却属于高风险 offensive security skill，应归类为高风险而非 benign。

该内容不是可执行的 npm 源代码，而是一份针对 NTLM 中继 SOCKS 代理横向移动的攻击操作指南。其明确支持认证捕获、凭据转储、机密提取、共享访问和远程命令执行，若在未授权环境使用将造成严重安全影响。未观察到代码级混淆或隐藏恶意载荷，但行为目的具有明显攻击性。

该输入不是恶意 npm 源代码，而是高度具体的 Responder/mitm6/ntlmrelayx 攻击操作文档。内容描述主动网络投毒、NTLM 凭据捕获、离线破解和认证中继，若未经授权使用会造成严重凭据泄露和域环境入侵风险。未观察到代码级混淆或隐藏恶意载荷。

该内容不是恶意 npm 代码，也未发现代码级后门或数据窃取实现；但它是一份可直接用于 NTLM 强制认证、凭据中继和共享文件投毒的高风险攻击指南。若在未授权环境使用，可能导致域凭据泄露、ADCS 证书滥用、LDAP 权限提升和域控制器失陷。

The fragment is an offensive Active Directory attack playbook that documents techniques capable of credential theft, privilege escalation, impersonation, domain-controller compromise, and remote execution. It is not executable package code in the portion shown, so direct npm malware behavior cannot be established; however, the documented actions present a high security risk if operationalized without authorization.

This fragment contains explicit, actionable attacker guidance for NTLM relay/coercion and ADCS/LDAP/SMB escalation intended to achieve domain compromise. It is not executable malware code, but it is highly suspicious and high-risk as supply-chain content because it can directly enable real-world intrusion when used by downstream systems or operators. No obfuscation is present.