subdomain-takeover

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 1.00). The subdomain https://abandoned.target.com is suspicious because the skill document explicitly shows it as a dangling CNAME vulnerable to subdomain takeover (allowing attacker-controlled hosting and potential malware/phishing distribution); the GitHub link is a benign reference.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This document contains explicit, actionable instructions to perform subdomain takeovers (e.g., creating S3 buckets, enabling hosting, uploading content) and describes attack outcomes like cookie/session theft, OAuth token theft and phishing — enabling direct malicious abuse.