ad-pentest

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill requires embedding user credentials and hashes directly into CLI commands and scripts (e.g., -p "$PASS", "${DOMAIN}/${USER}:${PASS}", examples showing literal passwords), which forces the agent to handle or output secret values verbatim.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This skill contains explicit, actionable offensive techniques—credential harvesting (Kerberoasting, AS‑REP roasting, Responder/NTLM relay), instructions for cracking and exfiltrating hashes, remote code execution and lateral movement (PsExec/SMBExec/WinRM/DCOM), and ADCS/ACL-based privilege escalation—capabilities that enable full domain compromise and thus present a high abuse risk if used without written authorization.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill's prerequisites clone and install external tooling (notably git clone https://github.com/lgandx/Responder into /opt/Responder and go install github.com/ropnop/kerbrute@latest) and then explicitly runs that fetched code at runtime (e.g., /opt/Responder/Responder.py, kerbrute), so these URLs supply remote code that is executed and are required dependencies.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill explicitly instructs installing tools into system paths (e.g., git clone to /opt), running commands with sudo (e.g., sudo Responder), and activating network attack/relay tooling that requires elevated privileges and modifies the host environment, so it pushes the agent to change the machine state and obtain privilege escalation.