js-analysis

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly runs secret-finding tools and regexes that extract sensitive tokens (AWS/Stripe/GitHub/Google, etc.) and write them to files/stdout (grep/tee/jsluice outputs), meaning an agent would need to capture or relay those secret strings verbatim, creating a high exfiltration risk.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This document is an explicit, actionable walkthrough for discovering and exfiltrating API endpoints and hardcoded secrets (AWS/Stripe/Slack/GitHub keys), and for identifying/authenticating exploitation targets — clearly facilitating credential theft and unauthorized access.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). This workflow downloads and processes outsider-authored public JS from runtime-supplied URLs (e.g., via katana/gau/httpx and curl in SKILL.md:35-60), then runs tools that ingest that downloaded JS as readable text (e.g., linkfinder.py, SecretFinder.py, jsluice), which would be fed into the agent/LLM context if the agent uses those tool outputs for LLM reasoning.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill instructs runtime installation of and execution from remote Go modules (which fetch and build remote code) such as "go install github.com/003random/getJS@latest", "go install github.com/BishopFox/jsluice/cmd/jsluice@latest", and "go install github.com/denandz/sourcemapper@latest", meaning external code is fetched and executed as a required dependency.