ato-chains

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 1.00). These URLs include attacker-controlled domains, username-in-host and typosquatted hostnames plus open-redirect parameters that can be abused to deliver malicious pages or exfiltrate tokens—strong indicators of a suspicious/malicious distribution vector.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This document is an explicit attacker playbook describing step-by-step techniques to perform account takeover (ATO), including token theft, OAuth redirect abuse, automated token harvesting, brute-force and chaining—to intentionally enable malicious account compromise.