windows-ad

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill includes example commands that pass plaintext credentials on the command line (e.g., -u user -p pass) and references extracting/handling credentials (secretsdump/mimikatz), which would require the LLM to embed secret values verbatim if populated — a high exfiltration risk.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This skill document contains explicit, actionable guidance and tool recommendations for credential theft (mimikatz/secretsdump/golden tickets), NTLM relay/forced-auth attacks, AD CS abuse and EDR bypass techniques that enable deliberate Active Directory compromise and lateral movement.