analyzing-indicators-of-compromise

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). This skill includes code snippets that place API keys/secrets as literal string values (placeholders like "YOUR_VT_API_KEY", "YOUR_KEY", "API_KEY"), which encourages embedding real secrets verbatim into generated code/requests and creates an exfiltration risk.

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 1.00). These URLs include non‑trusted domains (e.g., suspicious.com) and an explicit direct link to an executable (http://malicious-site.com/payload.exe), both high‑risk indicators for malware distribution.