winrm-pentesting

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill contains many command examples that place plaintext passwords, NTLM hashes, and certificate/key file arguments directly in CLI invocations (and even literal example passwords like "Password123!" and "P@ssw0rd!"), which requires handling or emitting secret values verbatim and is therefore high-risk.

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 1.00). The two http://ATTACKER:8080/*.ps1 URLs are high-risk because they point to attacker-controlled direct PowerShell script files intended for remote download-and-execute (iex/DownloadString), a common malware distribution technique.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The content provides explicit offensive techniques (credential brute-forcing, credential relay/theft, remote code execution, reverse shell payload fetching, remote activation/persistence and file exfiltration) consistent with deliberate malicious / post-exploitation behavior.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill explicitly instructs running privileged local commands (sudo ntlmrelayx.py) and executing remote commands that create a new user (net user pwned ... /add) and other remote code execution techniques, which push the agent to obtain elevated privileges and modify machine state.