vnc-pentesting

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill explicitly instructs retrieving VNC password files or registry values, decrypting them (including passing encrypted password hex on the command line), and then using the resulting plaintext passwords to connect, which requires the LLM to handle and potentially emit secret values verbatim.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This content is an explicit playbook for unauthorized VNC access and post-exploitation (scanning, brute-forcing, stealing/decrypting VNC passwords, exploiting RCEs, reverse connections, screenshots/keylogging and credential harvesting), indicating clear malicious intent and potential for abuse.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly instructs fetching and executing remote code (git clone https://github.com/jeroennijhof/vncpwd and running it) and also references https://github.com/trinitronx/vncpasswd.py as a runtime tool for decrypting VNC passwords, so these URLs are used to retrieve and run external code during operation.

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I flagged literal cryptographic keys found in the references file. These are high-entropy, concrete 3DES key values that can be used to decrypt VNC password files (i.e., they are real, usable secrets). I did not flag obvious low-entropy examples or placeholders such as "password", "vnc", "123456", or environment variable placeholders because those are documentation/default examples and are explicitly ignored per the rules.