ClawHub
Back to skill

Security audit

Pentest Active Directory

Security checks for vulnerabilities and agentic risk

Overview

This skill is framed as a real Active Directory pentest tool, but its executable produces canned high-severity findings instead of performing the promised assessment.

Review before installing. The skill does not appear to exfiltrate data or install persistence, but it can produce misleading security reports. Do not rely on its findings for Active Directory risk decisions unless the implementation is corrected to run real checks or is clearly labeled as mock/test scaffolding.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/active_directory.py:25
Finding

Fabricated High-Severity Findings Presented as Validated Test Results

Content
View full analysis
dict: return {'finding_id':f"{SKILL_NAME.replace('-', '_')}-001",'skill':SKILL_NAME,'timestamp':datetime.now(timezone.utc).isoformat(),'target':target,'title':'Pentest Active Directory identified a security weakness','cve':'N/A','cwe':'CWE-693','cvss_score':8.0,'cvss_vector':'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L','owasp_category':'A05:2021 - Security Misconfiguration','mitre_attack':'TA0006, TA0008','severity':'High','description':'Automated and manual testing identified a security condition requiring remediation.','proof_of_concept':'python scripts/active_directory.py --dry-run','screenshot':'assets/findings/placeholder.png','remediation':'Apply least privilege, secure defaults, and verify fixes with retest.','references':["https://github.com/BloodHoundAD/BloodHound", "https://github.com/BloodHoundAD/SharpHound"],'status':'open'} def main()->int: args=parse_args() scope_ok,scope_meta=validate_scope(args.target,args.scope) report_path=resolve_output_file(args.output,args.format,REPORT_STEM) if not scope_ok: r={'status':'error','summary':'TARGET NOT IN AUTHORIZED SCOPE - ABORTING','artifacts':[str(report_path)],'details':{'skill':SKILL_NAME,'target':args.target,'scope':scope_meta,'dry_run':args.dry_run}} render_result(r,report_path,args.format); print(json.dumps(r,indent=2)); return 1 if not args.i_have_authorization and not args.dry_run: r={'status':'error','summary':'You must pass --i-have-authorization to confirm written authorization.','artifacts':[str(report_path)],'details':{'skill':SKILL_NAME,'target':args.target,'scope':scope_meta,'dry_run':args.dry_run}} render_result(r,report_path,args.format); print(json.dumps(r,indent=2)); re ...[truncated 3171 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The skill advertises Active Directory attack-path assessment capabilities, including roasting, relay, and delegation abuse, but the provided skill file only defines workflow text and a command invocation without any evidence that the promised checks are actually implemented. In a security testing context, this can create dangerous false assurance: operators may believe critical AD attack paths were assessed when they were not, causing serious gaps in coverage and missed privilege-escalation risk.

Content

No source excerpt is available for this finding.

YARA rule 'offensive_tool_references': References to well-known offensive security tools [hacktools]

High
Category
YARA Match
Confidence
70% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · references/tools.md (reported line 5)May include surrounding context.

md
# Pentest Active Directory Tools

| Tool | URL |
|---|---|
| BloodHound | https://github.com/BloodHoundAD/BloodHound |
| SharpHound | https://github.com/BloodHoundAD/SharpHound |
| Impacket | https://github.com/fortra/impacket |
| mimikatz | https://github.com/gentilkiwi/mimikatz |
| NetExec | https://github.com/Pennyw0rth/NetExec |
| Certipy | https://github.com/ly4k/Certipy |

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High
Category
YARA Match
Confidence
75% confidence
Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · references/tools.md (reported line 8)May include surrounding context.

md
# Pentest Active Directory Tools

| Tool | URL |
|---|---|
| BloodHound | https://github.com/BloodHoundAD/BloodHound |
| SharpHound | https://github.com/BloodHoundAD/SharpHound |
| Impacket | https://github.com/fortra/impacket |
| mimikatz | https://github.com/gentilkiwi/mimikatz |
| NetExec | https://github.com/Pennyw0rth/NetExec |
| Certipy | https://github.com/ly4k/Certipy |

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The script advertises Active Directory attack-path assessment but only validates scope/authorization and writes canned placeholder findings. This is dangerous because operators may rely on fabricated results, leading to false assurance, bad remediation decisions, or incorrect evidence in security workflows.

Content

No source excerpt is available for this finding.

YARA rule 'offensive_tool_references': References to well-known offensive security tools [hacktools]

High
Category
YARA Match
Confidence
70% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · scripts/active_directory.py (reported line 27)May include surrounding context.

python
isconfiguration','mitre_attack':'TA0006, TA0008','severity':'High','description':'Automated and manual testing identified a security condition requiring remediation.','proof_of_concept':'python scripts/active_directory.py --dry-run','screenshot':'assets/findings/placeholder.png','remediation':'Apply least privilege, secure defaults, and verify fixes with retest.','references':["https://github.com/BloodHoundAD/BloodHound", "https://github.com/BloodHoundAD/SharpHound"],'status':'open'}

def main()->int:
    args=parse_args()
    scope_ok,scope_meta=validate_scope(args.target,args.scope)
    report_path=resolve_output_file(args.output,args.format,REPORT_STEM)
    if not scope_ok:
        r={'status':'error','summary':'TARGET NOT IN AUTHORIZED SCOPE - ABORTING','artifacts':[str(report_path)],'details':{'skill':SKILL_NAME,'target':args.target,'scope':scope_meta,'dry_run':args.dry_run}}
        render_result(r,report_path,args.format); print(json.dumps(r,indent=2)); return 1
    if not args.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The module docstring and CLI help text imply real pentest functionality, but the implementation only emits static placeholder results. In a security-testing skill, misleading documentation materially increases operational risk because users may treat synthetic output as validated AD findings.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.