rdp-pentesting

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill includes numerous command examples that embed passwords and NTLM hashes directly on the command line (e.g., -p '', /p:, /pth:, literal 'password123'), meaning an agent following it would be instructed to include secret values verbatim in outputs/commands.

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 1.00). All five URLs point to GitHub repositories hosting offensive RDP tools/post‑exploitation frameworks (brute‑force, backdoor discovery, session hijacking, remote command execution) which are high‑risk, dual‑use code that attackers commonly use to distribute or run malware.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This repository contains explicit, actionable offensive techniques for RDP compromise (credential attacks, session hijacking, persistent backdoors, remote code execution, and tunneling) that enable unauthorized access, credential theft, and persistence—indicative of deliberate malicious/abusive intent.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill instructs replacing system binaries (sethc.exe/utilman.exe) to get SYSTEM shells and adding users to the "Remote Desktop Users" group (net localgroup ... /add), both of which modify the host system state and require elevated privileges, so it should be flagged.