smb-pentesting

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill repeatedly shows and instructs embedding plaintext credentials, passwords and NT hashes directly into command-line examples (e.g., -u/-p, 'user%pass', mount -o "username=...,password=..."), which would require the LLM to handle or insert secret values verbatim.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This document is an offensive SMB/CIFS penetration-testing playbook providing explicit, actionable instructions for credential theft (NTLM capture, Pass‑the‑Hash), remote code execution (EternalBlue, PrintNightmare, psexec, reverse shells), NTLM relay, and deployment of malicious payloads—capable of being used as backdoors and for data exfiltration.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.90). The skill includes explicit instructions to run privileged commands on the agent host (e.g., "sudo ntpdate" and mounting CIFS shares with mount -t cifs), which requires/asks for sudo and can change the agent machine's state.