web-security-audit

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). Insecure: the skill explicitly searches for API keys/JWTs (e.g., sk_live_, AIza, eyJ...), extracts them from JS, and then instructs using those exact values in curl requests and to list "claves encontradas" in the final HTML report, which requires the LLM to handle and output secret values verbatim.

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). These are not direct executable download links but they include explicit malicious domains (evil-attacker.com, TARGET.evil.com), personal/project hosting (PROJECT_REF.supabase.co) and open-redirect/parameterized endpoints that can be abused to host or redirect to malware, so they should be treated as suspicious (moderate–high risk).

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The skill contains explicit, actionable scripts and commands to locate and extract secrets (API keys, JWTs), enumerate and read database/storage contents, and perform write/delete and CVE-exploit tests — behaviors that enable data exfiltration and system compromise if executed without authorization.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). La skill ejecuta curl en tiempo de ejecución contra https://TARGET (p. ej., Fase 1A/1B/1D/2/4/5/6/11/12) y luego inserta el contenido recuperado (HTML/JS/JSON/errores) en el contexto del agente vía variables como PAGE, CHUNKS, result y búsquedas/decodificación (grep, echo "$RSC", echo "$result" | ...), lo que puede incluir texto de terceros (páginas/JS/JSON del sitio objetivo) no elegido por el usuario.