llm-ai-security

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The prompt contains explicit attack payloads and output templates that instruct an LLM to embed user secrets (conversation contents, API keys like "sk_live_...") verbatim into generated outputs (URLs/markdown images), which would require the model to handle/output secret values directly.

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 1.00). High risk — many links point to an attacker-controlled domain used to host payloads and exfiltration endpoints (including a direct payload.txt), and the internal metadata endpoint 169.254.169.254 is listed (SSRF/credential-exfiltration risk).

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The document contains explicit, actionable examples of data exfiltration and remote code-execution/backdoor techniques (attacker-controlled URLs, image-URL exfil, shell injection, fetched payload execution, SSRF, and invisible ASCII smuggling) that could be used for deliberate abuse.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.90). The skill prompt includes examples that instruct or encourage executing arbitrary shell commands (e.g., "rm -rf"), reading sensitive system files (e.g., /etc/passwd), and sandbox escape/RCE patterns, which can modify or wholly compromise the host running the agent.