Back to skill

Security audit

Security Passwords

Security checks for vulnerabilities and agentic risk

Overview

This is a static password-wordlist skill for authorized security testing, with no executable behavior or hidden persistence.

Install this only if you need common-password lists for systems you own or are explicitly authorized to test. The lists can enable abusive login attempts if misused and may include offensive words from real-world password corpora.

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (22)

Harmful Content Injection

Critical
Category
Prompt Injection
Confidence
70% confidence
Finding

This content may contain harmful instructions that could cause physical harm if followed. CRITICAL: Review carefully before use.

Content

Scanner excerpt · references/Passwords/Common-Credentials/100k-most-used-passwords-NCSC.txt (reported line 55419)May include surrounding context.

text
bumble
books
hose
heyyou
houston1
hemlock
hippo
hornets
hurricane
horseman
hogan

Harmful Content Injection

Critical
Category
Prompt Injection
Confidence
70% confidence
Finding

This content may contain harmful instructions that could cause physical harm if followed. CRITICAL: Review carefully before use.

Content

Scanner excerpt · references/Passwords/Common-Credentials/10k-most-common.txt (reported line 7795)May include surrounding context.

text
bumble
books
hose
heyyou
houston1
hemlock
hippo
hornets
hurricane
horseman
hogan

Harmful Content Injection

Critical
Category
Prompt Injection
Confidence
70% confidence
Finding

This content may contain harmful instructions that could cause physical harm if followed. CRITICAL: Review carefully before use.

Content

Scanner excerpt · references/Passwords/Common-Credentials/probable-v2_top-12000.txt (reported line 11039)May include surrounding context.

text
bumble
books
hose
heyyou
houston1
hemlock
hippo
hornets
hurricane
horseman
hogan

Harmful Content Injection

Critical
Category
Prompt Injection
Confidence
70% confidence
Finding

This content may contain harmful instructions that could cause physical harm if followed. CRITICAL: Review carefully before use.

Content

Scanner excerpt · references/Passwords/Common-Credentials/100k-most-used-passwords-NCSC.txt (reported line 29734)May include surrounding context.

text
brittney
bones
bazooka
aviation
avalanche
anthrax
airport
admiral
666999
19841984
123qweasdzxc

Harmful Content Injection

Critical
Category
Prompt Injection
Confidence
70% confidence
Finding

This content may contain harmful instructions that could cause physical harm if followed. CRITICAL: Review carefully before use.

Content

Scanner excerpt · references/Passwords/Common-Credentials/10k-most-common.txt (reported line 6335)May include surrounding context.

text
brittney
bones
bazooka
aviation
avalanche
anthrax
airport
admiral
666999
19841984
123qweasdzxc

Harmful Content Injection

Critical
Category
Prompt Injection
Confidence
70% confidence
Finding

This content may contain harmful instructions that could cause physical harm if followed. CRITICAL: Review carefully before use.

Content

Scanner excerpt · references/Passwords/Common-Credentials/probable-v2_top-12000.txt (reported line 3870)May include surrounding context.

text
brittney
bones
bazooka
aviation
avalanche
anthrax
airport
admiral
666999
19841984
123qweasdzxc

Harmful Content Injection

Critical
Category
Prompt Injection
Confidence
70% confidence
Finding

This content may contain harmful instructions that could cause physical harm if followed. CRITICAL: Review carefully before use.

Content

Scanner excerpt · references/Passwords/Common-Credentials/100k-most-used-passwords-NCSC.txt (reported line 52070)May include surrounding context.

text
penthouse
peanutbutter
oxymoron
options
onetime
oleander
ohmygod
ocelot
oceans
nightfall
nicky

Harmful Content Injection

Critical
Category
Prompt Injection
Confidence
70% confidence
Finding

This content may contain harmful instructions that could cause physical harm if followed. CRITICAL: Review carefully before use.

Content

Scanner excerpt · references/Passwords/Common-Credentials/probable-v2_top-12000.txt (reported line 6629)May include surrounding context.

text
penthouse
peanutbutter
oxymoron
options
onetime
oleander
ohmygod
ocelot
oceans
nightfall
nicky

Harmful Content Injection

Critical
Category
Prompt Injection
Confidence
70% confidence
Finding

This content may contain harmful instructions that could cause physical harm if followed. CRITICAL: Review carefully before use.

Content

Scanner excerpt · references/Passwords/Common-Credentials/probable-v2_top-12000.txt (reported line 11910)May include surrounding context.

text
deception
daytime
darien
darby
damocles
cyanide
cunningham
crossroad
critters
crickets
crabtree

YARA rule 'offensive_tool_references': References to well-known offensive security tools [hacktools]

High
Category
YARA Match
Confidence
70% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · references/Passwords/Common-Credentials/100k-most-used-passwords-NCSC.txt (reported line 53850)May include surrounding context.

text
lia
ethereal
emotions
dudedude
drizzle
drive
douglass
doofus
dominika
doll
divers
diva
dipper
desperados
demetrio
demented
deliver
deepak
decision
datsun
darrel
cuthbert
culture
crunchy
crappy
cornel
consult
compound
comatose
clocks
civilwar
circuit
chessie
charleston
chariot
chan
castello
caspar
carioca
candie
cachorro
bushman
bulletin
brown1
britain
brandnew
braden
boswell
bogus
bluegill
blue32
bloodhound
blondy
bliss
blanket
blader
billing
beautiful1
baywatch
bastardo
baraka
bagheera
babette
avanti
aurore
aspirin
asimov
arrows
arcade
april1
annalisa
anatomy
allstate
allegra
algeria
alfaromeo
aldebaran
alberto1
agenda
actress
accept
Samantha
Jackson
Elizabeth
963963
78945612
654654
2fast4u
2cool4u
2006
1957
1598753
159632
1234568
01010101
0007
zxzxzx
yellow12
woman
wolverines
wolfhound
wildbill
whittier
werty
watkins
warrant
vittoria
virgilio
vegetable
vangogh
uptown
upgrade
unbreakable
umberto
trusting
troubles
triplex
trading
tonytony
times
tiamat
thebest1
terriers
template
temper

YARA rule 'offensive_tool_references': References to well-known offensive security tools [hacktools]

High
Category
YARA Match
Confidence
70% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · references/Passwords/Common-Credentials/probable-v2_top-12000.txt (reported line 10559)May include surrounding context.

text
lia
ethereal
emotions
dudedude
drizzle
drive
douglass
doofus
dominika
doll
divers
diva
dipper
desperados
demetrio
demented
deliver
deepak
decision
datsun
darrel
cuthbert
culture
crunchy
crappy
cornel
consult
compound
comatose
clocks
civilwar
circuit
chessie
charleston
chariot
chan
castello
caspar
carioca
candie
cachorro
bushman
bulletin
brown1
britain
brandnew
braden
boswell
bogus
bluegill
blue32
bloodhound
blondy
bliss
blanket
blader
billing
beautiful1
baywatch
bastardo
baraka
bagheera
babette
avanti
aurore
aspirin
asimov
arrows
arcade
april1
annalisa
anatomy
allstate
allegra
algeria
alfaromeo
aldebaran
alberto1
agenda
actress
accept
Samantha
Jackson
Elizabeth
963963
78945612
654654
2fast4u
2cool4u
2006
1957
1598753
159632
1234568
01010101
0007
zxzxzx
yellow12
woman
wolverines
wolfhound
wildbill
whittier
werty
watkins
warrant
vittoria
virgilio
vegetable
vangogh
uptown
upgrade
unbreakable
umberto
trusting
troubles
triplex
trading
tonytony
times
tiamat
thebest1
terriers
template
temper

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

This plain-text file contains natural-language entries such as slurs, which are policy-sensitive content even if they appear as password samples. Such content can violate language-safety expectations for repository content because it preserves and redistributes abusive language without contextual warning or filtering.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

This plain-text file contains natural-language entries such as slurs, which are policy-sensitive content even if they appear as password samples. Such content can violate language-safety expectations for repository content because it preserves and redistributes abusive language without contextual warning or filtering.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

This file includes derogatory identity-based language in a password entry. Even in dataset form, retaining such language without warning or access controls can conflict with organizational language-safety policy.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/Passwords/Common-Credentials/100k-most-used-passwords-NCSC.txt (reported line 18650)May include surrounding context.

text
honey215
carebears
cool22
ripcurl
linusd8
vanessa2
rainbows1

YARA rule 'network_reconnaissance': Network reconnaissance and scanning patterns [hacktools]

Medium
Category
YARA Match
Confidence
65% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · references/Passwords/Common-Credentials/100k-most-used-passwords-NCSC.txt (reported line 82311)May include surrounding context.

text
9
110796
hola22
ashland1
SILVIA
rrr123
lizette1
360001
dreamon1
papaya1
brille
greenway
156324
malena1
farthead1
archuleta
bamaboy1
jhkjdf
jopajopa
11031978
doremifa
250876
INDIAN
090581
momof6
yahoo6
1april
childcare
marlee1
f00bar
jacqui1
billard
sin666
adr
deleon1
1903bjk
edge
ZXC123
clairebear
ursulet
lkjh
11071996
loquillo
africa123
sanchez13
hyperlite1
buddy77
27072007
20042006
sneha
301095
fierce
042108
epa650
oscar69
eumesma
55555t
sorciere
pizzapie1
chichi11
24071994
fkg7h4f3v6
170878
julieanne
spider4
zero000
crackerjack
skully
jyoti
ludhiana
gabriel23
hannah95
rtyfghvbn
nose
bighouse
vader123
packers123
blessedbe
shonda
obelisk
booger69
696969j
qwerty28
monica15
271278
holidaysecure123$
27021980
14021977
145353
simpleman
divina1
megan15
sicherheit
s0ftball
49494949
skittles14
vertex
failure
charmin1
shinedown1
04041978
slayer7
031984
postoffice
notyou
longfellow
310395
03071995
112005
mike666
05071980
jemoeder1
198588
gomets
mercury7
oreo10
casado
600087
Madonna
Jehovah
kand

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The file is a plain-text wordlist, so only SQP-3 applies here in addition to any text-file rules. Entries like "nigger" are explicit slurs embedded as natural-language content, which can conflict with organizational content policies even if included as data.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The entry on this line is a well-known anti-gay slur. Even in a password corpus, retaining such terms without labeling or justification can violate policy requirements around harmful language in repository content.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The listed password candidate is a racial slur variant. Because SQP-3 applies to all file types, harmful natural-language content embedded in datasets should be reviewed for policy compliance.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

This line contains a racial slur with a numeric suffix, which is still recognizable harmful language. Its presence in a broadly distributed plaintext file can create policy-compliance issues.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This plain-text file contains human-language entries that include racial slurs and abusive language, such as the value on L0503. Even in a password reference list, such content is a natural-language policy concern because it reproduces harmful language without any surrounding explanation, limitation, or warning in the file itself.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
78% confidence
Finding

This plain-text file includes many non-English terms such as Spanish and other locale-specific words, but provides no surrounding documentation indicating that the list is intentionally multilingual or region-scoped. Per the policy rule, forcing or implicitly assuming language/locale content without opt-in or justification can be a natural-language policy concern.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.