set

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly directs cloning sites to harvest credentials, logging and displaying captured creds (and asks for SMTP credentials), which requires handling and outputting plaintext secrets verbatim.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This skill explicitly documents and automates spear-phishing, credential-harvesting via cloned sites, payload/exploit delivery, credential logging/exfiltration, and mass-mailing — behaviors that are clearly designed for intentional malicious abuse.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 1.00). The SKILL.md explicitly instructs the credential-harvester workflow (1 > 2 > 3 > 2) to "Enter URL to clone (e.g., https://mail.google.com)" and clones public websites, meaning it fetches and ingests arbitrary third-party web content which the agent reads/interprets as part of its phishing workflow.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The prompt explicitly instructs running commands with sudo (e.g., sudo setoolkit), references and writes to root- and /etc-level files, and guides credential harvesting, site cloning, and payload delivery—actions that require elevated privileges and modify the host state.