pop-pentesting

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly shows and instructs embedding credentials in commands (e.g., USER/PASS, hydra with -P, telnet example including "PASS password") which requires the LLM to produce or handle secret values verbatim, creating an exfiltration risk.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The content is an explicit playbook for unauthorized access: it instructs brute-forcing credentials, extracting email contents (including passwords, API keys), NTLM info harvesting, and using Metasploit/nmap/hydra — enabling data exfiltration and credential theft.