file-upload

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.95). Several URLs are attacker-controlled or point to uploaded files with double extensions (e.g., shell.php.png) and external DTD/JS callbacks, which are strong indicators of malicious payload hosting and exploitation channels.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This document is an explicit attacker-facing guide describing multiple, actionable file-upload exploitation techniques (webshells, RCE, XXE, SVG/HTML XSS with cookie exfiltration, .htaccess abuse, ZIP-slip, CSV formula payloads, race conditions, etc.), indicating deliberate malicious intent and high risk of abuse.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). This skill explicitly instructs uploading executable payloads, using .htaccess and path traversal to overwrite system files (e.g., /var/www/html, /etc/passwd), and other techniques that would modify a host's filesystem and enable remote code execution, so it should be flagged.