performing-csrf-attack-simulation

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt includes explicit examples that embed session cookies and CSRF tokens directly in curl commands and request bodies (e.g., -b "session=abc123", csrf_token=...), which requires the agent to handle and output secret/session values verbatim.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). This document provides concrete, actionable CSRF payloads and step‑by‑step instructions (including PoC HTML/JS, curl examples, and hosting guidance) that can be directly abused to perform account takeover, unauthorized state changes (email change, fund transfer, 2FA disable) and thus poses a high abuse risk despite its stated authorization notice.