sliver-c2

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The guide includes insecure patterns: an explicit example that embeds credentials on the command line (secretsdump.py domain/user:pass@...), and it instructs non‑interactive tmux capture of session output plus use of tools that extract credentials (mimikatz/nanodump), so secrets could be captured and exposed verbatim to the agent/output.

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 1.00). The URL points to a remote install script for "Sliver" (an offensive C2 framework) and encourages piping a downloaded script to bash — a direct remote installer for a command-and-control tool is a high-risk delivery vector commonly used to distribute malware.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This document is a detailed operational guide for the Sliver C2 framework that explicitly instructs how to generate and deploy implants/backdoors, perform remote code execution and pivoting, dump and exfiltrate credentials (LSASS/mimikatz/rubeus), capture keystrokes/screenshots, and route/exfiltrate network traffic — clearly intended to enable offensive unauthorized access and post-exploitation activity.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill contains a runtime installation command that fetches and executes remote code ("curl https://sliver.sh/install | sudo bash"), so https://sliver.sh/install is flagged because it downloads and runs external code as a required setup step.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). This skill explicitly instructs privileged system changes (curl ... | sudo bash install, sudo sed -i on /etc/proxychains4.conf), generating/uploading/executing implants and post‑exploitation actions (mimikatz, getsystem), which clearly request sudo use and modification of system state and credential material.