pt-lotl-techniques
Demonstrates Living-off-the-Land (LotL) techniques using native OS tools to simulate realistic threat actor behavior during authorized penetration tests. Use when proving attack feasibility without custom malware, testing detection coverage, and validating what a real adversary could achieve with only built-in system capabilities.
84
76%
Does it follow best practices?
Impact
98%
1.24xAverage score across 3 eval scenarios
Critical
Do not install without reviewing
Optimize this skill with Tessl
npx tessl skill review --optimize ./skills/pt-lotl-techniques/SKILL.mdSecurity
3 findings — 1 critical severity, 1 high severity, 1 medium severity. Installing this skill is not recommended: please review these findings carefully if you do intend to do so.
E006: Malicious code pattern detected in skill scripts
What this means
Detected high-risk code patterns in the skill content — including its prompts, tool definitions, and resources — such as data exfiltration, backdoors, remote code execution, credential theft, system compromise, supply chain attacks, and obfuscation techniques.
Why it was flagged
Malicious code pattern detected (high risk: 1.00). The document explicitly details techniques for credential theft, persistence, lateral movement, remote code execution, and data exfiltration using built-in OS tools—high-risk, dual‑use behaviors that can enable backdoors and unauthorized compromise despite being framed for authorized testing.
W007: Insecure credential handling detected in skill instructions
What this means
The skill handles credentials insecurely by requiring the agent to include secret values verbatim in its generated output. This exposes credentials in the agent’s context and conversation history, creating a risk of data exfiltration.
Why it was flagged
Insecure credential handling detected (high risk: 1.00). The prompt explicitly instructs reading credential files/outputs and to "record full command line" and "Output observed," which would require capturing and outputting secret values verbatim if present.
W013: Attempt to modify system services in skill instructions
What this means
The skill prompts the agent to compromise the security or integrity of the user’s machine by modifying system-level services or configurations, such as obtaining elevated privileges, altering startup scripts, or changing system-wide settings.
Why it was flagged
Attempt to modify system services in skill instructions detected (high risk: 1.00). The prompt explicitly instructs creating/modifying persistence mechanisms (services, systemd units, cron, registry run keys, SSH authorized_keys), using sudo abuse and lateral-movement techniques—actions that change system state and require/encourage privileged access.
- Repository
- santosomar/ethical-hacking-agent-skills
- Commit
a8ff73a
- Audited
- Security analysis
Is this your skill?
If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.