competition-windows-pivot

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The skill explicitly directs recovering and preserving raw credential artifacts (SAM/NTDS/LSA/DPAPI, tickets, hashes, cookies, vault blobs) and to keep raw host artifacts and ticket fields, which would require the LLM to handle or output secret values verbatim.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The documents provide explicit, actionable instructions for extracting credentials (SAM/NTDS/LSASS/DPAPI), replaying Kerberos tickets, and performing Windows lateral movement, which are clearly intended to enable unauthorized access and credential exfiltration.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). This skill explicitly directs the agent to access and extract highly privileged system artifacts (SAM, NTDS, LSA/DPAPI secrets, etc.) and to trace replay/privilege paths, which requires elevated access and facilitates compromising the host state.