competition-lsass-ticket-material

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill explicitly instructs the agent to record and "keep" extracted secrets (e.g., "extracted secret", ticket caches, plaintext, hashes, DPAPI secrets) as part of the host-artifact-to-replay chain, which would require the LLM to handle and potentially output secret values verbatim.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). 该技能明确指导在 LSASS/票据缓存 中定位、提取并回放凭据（明文、哈希、TGT、DPAPI 等），以获取远程会话与特权，属于高风险的凭证窃取与横向移动行为。

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill explicitly directs extracting, recording, and replaying credentials from LSASS/DPAPI memory (host-artifact-to-replay chains), which inherently requires privileged access and would compromise the machine's security state.