Privilege Escalation Methods

Fail

Audited by Socket on Feb 19, 2026

1 alert found:

Malware
MalwareHIGH
SKILL.md

[Skill Scanner] URL pointing to executable file detected All findings: [CRITICAL] command_injection: URL pointing to executable file detected (CI010) [AITech 9.1.4] [HIGH] data_exfiltration: Credential file access detected (DE002) [AITech 8.2.3] This skill is an explicit, actionable guide for local and domain privilege escalation, credential harvesting, persistence, and post-exploitation operations. It contains numerous direct command examples that enable theft of credentials (NTDS.dit, LSA secrets), setuid shell creation, loading vulnerable drivers, scheduled tasks that fetch remote payloads, and relay/exfiltration techniques. As such it is unsafe for general distribution and represents a high security risk if used without explicit authorization and controls. Treat as malicious-capability documentation and restrict access to authorized red-team operators within legal engagements. LLM verification: This Skill contains explicit, actionable post-exploitation instructions that enable local privilege escalation, credential harvesting, persistence, and domain compromise. While framed for legitimate penetration testing and red-team use, the content is highly dangerous if used outside controlled, authorized environments. The presence of an example attacker URL and direct guidance to copy sensitive artifacts (NTDS.dit, SSH keys) and set SUID on binaries demonstrates high potential for abuse. Treat

Confidence: 95%Severity: 95%
Audit Metadata
Analyzed At
Feb 19, 2026, 06:41 PM
Package URL
pkg:socket/skills-sh/jpropato%2Fsiba%2Fprivilege-escalation-methods%2F@eb018240591b5e94ba9a8656cb5af528b834775c