bug-bounty

This is not a normal developer-assistance skill; it is an offensive exploit playbook for AI agents. Its capabilities align with its stated red-team purpose, but that purpose includes active exploitation, prompt-injection abuse, exfiltration techniques, system-prompt extraction, and supply-chain attack guidance. Treat as high-risk and suspicious rather than confirmed malware: the content is overtly dangerous and enables misuse, but it does not itself contain hidden load-time execution or confirmed credential theft by the publisher.

SUSPICIOUS: the skill is internally coherent as a bug-bounty/offensive-security playbook, but that purpose itself grants an AI agent broad exploit-oriented capabilities, target interaction, credential handling, and exfiltration patterns. The main concern is not deception; it is that this skill operationalizes high-risk security testing against real external systems with medium supply-chain risk from numerous tool installs.

This skill is not covert malware, but it is a high-risk offensive exploitation toolkit for AI agents. Its capabilities align with its stated purpose, yet that purpose itself includes credential theft PoCs, exfiltration patterns, auth bypass, WAF evasion, and RCE guidance against external targets; overall classify as SUSPICIOUS/high-risk rather than benign or confirmed malware.

SUSPICIOUS: the skill is internally consistent as a bug bounty/offensive security playbook, but that stated purpose itself grants an AI agent broad penetration-testing and exploit guidance against real systems. Main risk is offensive capability enablement plus medium supply-chain exposure from many unpinned tool installs and third-party skill/repo loading.

SUSPICIOUS/HIGH-RISK skill. Its real footprint is an offensive security playbook for AI agents: recon, port scanning, secret hunting, source-code recovery, and techniques that directly enable exploitation. The install path is mostly normal developer tooling, but the capability scope exceeds simple asset discovery and gives the agent penetration-testing and credential-extraction instructions against external targets.

No clear malware behavior is present. The code is a readable security-scanning orchestrator, but it has shell-injection exposure in shell-enabled command construction, incomplete target path validation, and optional scope enforcement. The undefined `epilog` reference also appears to prevent normal startup.

The fragment exhibits multiple high-risk, adversary-friendly trading mechanics: (1) router swaps accept unbounded slippage (`amountOutMin=0`), (2) swaps can be forced through an owner-configured routing pool (`mandatoryPool`), and (3) rebasing can be triggered during DEX interactions (`_rebase()` in `_transfer` when touching `uniswapPair`). Together these create predictable conditions for MEV/sandwich exploitation and unfair price impact. There is no clear evidence of classic off-chain/on-system malware (exfiltration, backdoors, persistence), but the economic extraction and user-trading safety risk are substantial given the shown logic.

This skill is coherent with its stated purpose as a Web3 security research and audit methodology guide, but it equips an AI agent with offensive security workflows and includes commands to install tools, clone PoC repos, and run analysis/exploit tests. No clear credential theft, stealth, or malicious exfiltration is present; the main risk is enabling high-impact security testing and executing third-party research code.

The provided file is best characterized as an offensive WebSocket testing/exploitation harness with explicit CSWSH-style credential abuse and direct exfiltration of WebSocket-received data to an attacker-controlled domain. The code contains multiple hardcoded attack probes (authz/authn bypass testing, IDOR via victim identifiers, XSS/SQLi-like payloads, and admin action attempts). There is no evidence of obfuscation; the suspiciousness is in the explicit malicious behavior and payloads. If this behavior appears in a dependency that can be executed automatically during install or runtime, it should be treated as a critical supply-chain red flag and removed/reviewed urgently.

This is an active reconnaissance script rather than apparent malware. The direct interpolation of the target into Python source is a concrete code-injection risk for untrusted target arguments. Reusing authentication headers across discovered URLs without visible per-URL scope validation can also expose credentials if the input or recon results include out-of-scope hosts. Use only with authorized targets and escape or pass the target as data to Python.

This module is best characterized as a malicious payload generator: it implements deliberate Unicode steganography (U+2062/U+2064) to embed hidden prompt-injection instructions inside otherwise visible text, and it also packages extensive offensive security exploitation/probing payloads. While it does not execute commands or perform network exfiltration directly, it produces and exports weaponized artifacts (including cleartext references) intended for downstream abuse against LLMs/assistants or security targets. Treat as unsafe/malicious in a software supply chain context; it should not be included in trusted dependencies.

No clear package malware, credential theft, persistence, or unrelated data exfiltration is evident. This is an active vulnerability scanner with potentially disruptive probes, notably executable upload PoCs and SAML/MFA POST tests. Use only with explicit authorization; the unsafe-method guard does not cover every request, and findings based solely on HTTP status may be unreliable.

SUSPICIOUS/HIGH-RISK skill. It is not confirmed malware and the flagged pre-execution/injection patterns look like documentation false positives, but the skill's actual purpose is to operationalize credential attacks and follow-on authenticated exploitation using external offensive tools and real login endpoints. That makes it a high-risk offensive-security skill for AI agents.

This module is best characterized as an offensive, dual-use authorization scanner/exploitation harness rather than malware. It actively probes cross-user data access (IDOR), performs potentially state-changing GraphQL mutations, attempts 2FA rate-limit testing via rapid OTP submissions, and evaluates CORS/CSRF-related behavior. It also prints and stores potentially sensitive API responses in memory/console, increasing the risk of sensitive data exposure to whoever runs/logs it. No classic stealth/backdoor/payload execution indicators are present in this fragment; the primary risk is abuse and data exposure inherent to its scanning behavior.

SUSPICIOUS: the skill is internally coherent as a bug-bounty reversing guide, but its actual footprint is an offensive security capability for bypassing client protections and testing protected endpoints. Install/data-flow trust is mostly benign and standard, yet the exploit-oriented purpose makes this high security risk even without clear malware or credential theft behavior.

SUSPICIOUS/HIGH-RISK offensive-security skill. Its capabilities align with bug bounty hunting, but that stated purpose itself grants an AI agent broad recon, exploit-testing, and potential data-access behavior against external systems. No malicious pre-execution payload is present, and tool references mostly map to legitimate security utilities, but the missing local helper code and autonomous attack workflow keep overall risk high.

SUSPICIOUS/HIGH-RISK skill. Its capabilities are internally consistent with its stated purpose, but that purpose is to give an AI agent offensive mobile pentesting capability, including SSL-pinning bypass, runtime hooking, and exploit-chain discovery. Install trust is mostly acceptable for official tools, but the third-party Frida CodeShare reference adds supply-chain risk. Not confirmed malware, but inappropriate/high-risk as an agent skill because it operationalizes offensive security actions against external targets.

SUSPICIOUS: The skill is internally coherent for web3 smart-contract auditing and shows no credential harvesting, hidden exfiltration, or mismatched data flows. However, it materially equips an AI agent to perform offensive security work against DeFi targets, so it is high-risk dual-use rather than benign documentation.

SUSPICIOUS. The skill is coherent as a GraphQL offensive security audit skill, but its actual purpose is to equip an AI agent with penetration-testing techniques, including injection, IDOR, auth bypass, brute-force amplification, and DoS-style probes. The main concrete security issue is broad offensive capability plus unpinned third-party tool installation; there is no clear evidence of credential theft, covert exfiltration, obfuscation, or deceptive data routing.

The analyzed fragments collectively present a high-risk security profile dominated by upgradeability governance weaknesses, insufficient signature-domain protections, potential ERC4626 mispricing, and role-management uncertainties. Even without explicit exploit code, the combination of unguarded upgrade paths, reinitialization risks, and asset-control surfaces warrants treating the package as unsuitable for production use until a thorough, context-specific audit is completed and remediation is applied (tighten upgrades, implement proper nonce/domain handling, secure ERC4626 pricing, complete initializer safeguards, and fix role grants). Security risk is high due to the potential for unauthorized upgrades, replay and DoS vulnerabilities, and financial manipulation; operational risk is significant until fixes are applied.

This is a PoC verification utility, not evidently malware. Replaying an untrusted bundle can send attacker-selected requests and environment-variable values to a remote endpoint. Use only trusted bundles and inspect their URL, method, headers, and body before verification. The effectiveness of redirect and DNS protections cannot be assessed from this file alone.

This skill is internally coherent: its exploit, exfiltration, and CI-focused scanning guidance all match the stated purpose of CI/CD security hunting. It is not disguised credential theft or an incoherent lure, but it is a high-risk offensive security skill because it enables an AI agent to identify and exercise command injection, secret exfiltration, and runner/cloud abuse against external targets. Install trust is mostly acceptable from official sources, with moderate residual risk from unspecified helper scripts.

No direct evidence of hidden malware (no eval/dynamic code execution from untrusted data, no credential theft/exfiltration, no backdoor/persistence in this snippet). However, the script carries significant supply-chain risk by executing a remote installer script (Homebrew install via curl piped into bash), installing many third-party binaries through package managers, downloading and extracting a third-party binary (sisakulint) from GitHub releases (checksum-checked but version discovery is ‘latest’), updating nuclei templates, and cloning external repositories in credential-attack mode. If upstream repositories/releases or dependency chains were compromised, this installer would faithfully install and potentially run the malicious payloads. Overall: likely a legitimate tool installer with inherent supply-chain exposure rather than clear sabotage in the provided fragment.

This module is best classified as an offensive security testing tool for Zendesk with high misuse potential: it performs authorization-bypass-style IDOR enumeration, unauthenticated exposure probing, GraphQL introspection with optional local persistence, and—most importantly—creates tenant webhooks pointing to internal/metadata/localhost-style endpoints (an SSRF-style capability). No clear stealth/persistence or classic malware behavior is present in the visible fragment, but it can materially interact with and modify a tenant, making it a security-risk artifact if run without explicit authorization and tight scope controls.

This module is an offensive authorization-testing/exploitation tool. It uses user-supplied session cookies to authenticate against HackerOne, extracts CSRF tokens, performs cross-account read checks, and attempts multiple state-changing GraphQL mutations with real side effects (including closing/disclosure, bounty/assignment, and email sharing) while flagging potential authorization bypasses based on response content. While it is not obfuscated and does not exhibit classic malware behaviors like credential theft or exfiltration, its operational capability to enact unauthorized changes makes it a strong security risk if present as a dependency in a supply chain.

SUSPICIOUS. The skill is internally consistent as a meme-coin audit tool, but it gives an AI agent high-risk blockchain security/exploit-review capabilities. No clear credential theft, exfiltration, or malicious installer behavior is present, so this is not confirmed malware; the main concern is the appropriateness and misuse potential of offensive token-audit functionality.

The provided code fragment is an attacker-style GraphQL recon and active probing harness. It explicitly attempts bypasses (GET-based introspection when blocked), performs disruptive workload tests (batching/alias/depth bombs), runs injection-oriented scanning (gqlmap/SQLi-style probe), and persists detailed reconnaissance results to disk. While it is not obviously implementing persistence/stealth malware inside the fragment, its operational intent and side effects make it highly risky to distribute or execute against any systems without explicit authorization.

No direct malware indicators are present in this module (no persistence, obfuscation, system modification, or exfiltration to unknown hosts). However, the code is an active, authenticated, high-impact testing harness that can generate abuse-like traffic: concurrent 2FA OTP attempts, bounty award/accept races, negative/extreme bounty validation probes, and concurrent email changes. The main supply-chain dependency risk is the unknown behavior of tools.safe_http.safe_urlopen imported via a runtime sys.path adjustment. Treat this as security-sensitive/offensive tooling: likely safe only in tightly controlled, explicit authorization scenarios.

This is a parallel vulnerability-lead verification coordinator. The fragment contains no clear malware behavior, but target and lead_id path handling can allow writes outside the intended findings directory. Validate path components and enforce resolved-path containment before creating or writing files.

This fragment is best characterized as an offensive security testing script that actively probes auth/OAuth and password reset behaviors by sending crafted headers and parameters (attacker.com origin/host manipulation, redirect_uri bypass payloads, and bearer-token validation). While it does not obviously implement covert malware (no persistence, no process spawning, no hidden network exfiltration beyond the intended target, no keylogging/clipboard), it contains functionality commonly used in real attacks. Additionally, the snippet appears syntactically broken for check_ssrf_webhook(), and it imports safe_urlopen from a local module path that is not visible here—so supply-chain risk depends heavily on that dependency’s implementation.

This module is a credential-spraying/brute-force automation tool that performs repeated HTTP POST login attempts using operator-supplied username/password lists (and optional CSRF extraction), infers likely authentication success from response heuristics, logs attempt outcomes locally, and can stop on suspected hits. It also includes a fallback that disables TLS certificate verification if certifi is missing, further increasing operational risk. This represents a significant malicious/abusive supply-chain risk when included as a dependency, even though password values are only partially logged (hash prefixes).

This module is a credential-spraying/password-spray orchestrator. It collects operator-provided user/password lists and target endpoints, requires interactive confirmations designed to prevent wrong-target mistakes, then dispatches to networked credential-attack implementations (Python handlers and trevorspray) and persists run output to disk. While there are no obvious stealth/obfuscation techniques in this Bash fragment, the capability it enables is inherently high-risk and consistent with malicious or unauthorized authentication testing.

This module is an intentional DOM XSS testing/confirmation harness that actively injects and executes crafted JavaScript payloads in a headless browser, using a canary callback (`window.__cbbx`) and dialog/console events to classify findings as CONFIRMED or POSSIBLE. It shows no clear signs of classic malware behavior (no exfiltration, persistence, or credential theft) and contains minimal obfuscation. The main security risk is offensive misuse: it can be used to probe or exploit DOM XSS in real targets, and it can write screenshots to a user-supplied path; it also weakens TLS checks in the test context.

This module is best characterized as an upload/parser fuzzing and exploit-shaping utility. It intentionally constructs malformed and adversarial multipart/form-data payloads (including traversal-like Content-Disposition sub-parameter injection, NUL-byte boundaries, CRLF/LF mixing, nested boundaries, duplicate parameters, and encoding tricks). It can optionally POST these crafted payloads to an arbitrary user-specified URL. There is no direct evidence of covert malware behavior (no hidden exfiltration endpoints, no credential theft, no command execution), but the tool’s capabilities can materially facilitate attacking vulnerable servers or testing multipart upload handling in a way that could be misused. Use only with clear authorization and safeguards.

This module is highly suspicious and likely malicious in intent: it is explicitly a “hidden/invisible prompt injection” payload generator/encoder that conceals attacker instructions using Unicode stealth and can output/save ready-to-deploy injection artifacts. While it does not perform network exfiltration itself, it includes exfiltration-oriented instructions/URLs and prompt-injection objectives (system prompt/tool extraction, cross-tenant probing, RAG poisoning, and response overriding). Treat it as high-risk supply-chain tooling; avoid using it in dependencies for production or untrusted environments.

SUSPICIOUS. The skill is not malware and shows no credential theft, installer abuse, or exfiltration, but it is an offensive security hunting guide for a live blockchain target. Its footprint is text-only and internally consistent, yet the purpose enables AI-assisted exploit research, which makes it higher-risk than ordinary documentation.

This skill is purpose-consistent but high-risk: it is an offensive scanner suite for AI agents, including OOB callback confirmation and LLM jailbreak testing. Install trust for interactsh-client appears same-org and official, so this is not confirmed malware, but the capability set is inherently dangerous and unsuitable outside authorized security testing.

This module is a purpose-built offensive NoSQL injection/auth-bypass scanner. It actively sends crafted JSON payloads containing NoSQL/MongoDB-like operators and a timing-based {$where:'sleep(...)'} test to a user-supplied login endpoint, then classifies results using status/body-length deltas and response timing. While it does not show typical malware traits (persistence/exfiltration/stealth), its automated exploitation/probing capability makes it high risk if included in a supply chain without strict authorization controls. Additionally, it imports safe_urlopen via sys.path manipulation, which is a supply-chain dependency to audit separately.

This shell script is not a benign dependency; it functions as an offensive OSINT-to-credential-candidate pipeline. It harvests employee emails from public sources, derives/enriches names, generates username permutations, and (optionally) creates personal-style password candidates, then instructs how to use those artifacts for credential spraying. While the fragment shows no direct exfiltration or stealth, its end-to-end behavior materially enables unauthorized access attempts. Primary risks are (1) high misuse potential due to credential-spraying preparation and (2) execution of locally stored tools without integrity verification, increasing supply-chain/trust risk if those binaries are tampered.

SUSPICIOUS: the skill is internally consistent as an LLM red-teaming/offensive-security skill, but its actual purpose is to help an AI agent probe, coerce, and validate exploit paths in external AI systems. No clear credential harvesting, hidden exfiltration, or suspicious installer/data-routing appears in the supplied text, so this is not confirmed malware; however, it is a high-risk offensive capability and should not be treated as a benign general-purpose skill.

SUSPICIOUS/HIGH-RISK: the skill is internally consistent with its offensive purpose, but that purpose is to equip an AI agent with cloud exploitation, credential theft from metadata services, privilege escalation, secrets harvesting, and pivoting capabilities. There is no obvious third-party credential proxy or malware payload, but the capability set itself is high risk and appropriate only for tightly controlled authorized security testing.

SUSPICIOUS: the skill is internally consistent as an offensive security/red-team skill, but it equips an AI agent to conduct active exploitation of deployed agentic systems, including SSRF-style probing, cross-tenant data exposure checks, privileged action abuse, and unconfirmed destructive-action testing. No major supply-chain or credential-forwarding issue is present, but the offensive capability and real-world action testing make overall risk high.

This module is a high-risk, offensively purposed JWT attack toolkit. It can: (1) forge signature-bypass tokens via `alg=none`, (2) forge HS256-signed JWTs using attacker-supplied secret material and injected claims, (3) generate RS256->HS256 confusion demonstrations by treating a PEM blob as an HMAC secret, and (4) brute-force HS256 HMAC secrets offline from a wordlist. While it does not show network exfiltration or system command execution, its core functionality directly enables authentication bypass and secret compromise, making it unacceptable as a trusted dependency in security-sensitive contexts.

High misuse potential. The fragment is an operator-focused playbook that chains OSINT/breach-based candidate generation with staged decision logic culminating in HTTP-form credential spraying against a specified login endpoint, including persistent logging and resumable workflow design. Even though it instructs the agent not to execute and mentions dry-run/user consent gates, it remains directly actionable for authentication-attempt execution, which is strongly associated with malicious credential attacks.

This module is a credential-spraying automation tool targeting an OAuth2 password-grant token endpoint. It reads attacker-controlled user/password lists, repeatedly sends POST requests containing credentials, determines likely success by checking for access_token in responses, logs per-attempt results (including password hash prefixes and server error details), and reports plaintext credentials for detected hits in its runtime summary flow. While it is not obfuscated, its core functionality is high-risk and strongly aligned with unauthorized credential-stuffing activity. Include only in tightly controlled, authorized testing contexts with strict guardrails; treat it as extremely dangerous in general supply-chain scenarios.

No direct malware behavior is evident in this module: it does not execute commands, steal data, or persist. However, it is an active network vulnerability probing tool that crafts CRLF/header-injection payloads (including Host/proxy header manipulation) and reports reflected canary evidence; this capability is misuse-prone. Additional supply-chain uncertainty exists due to sys.path modification and reliance on an external safe_urlopen implementation that is not shown here.

This module is high-risk client-side reconnaissance code. It installs hooks on fetch and XHR to capture and retain GraphQL/AI/Hai/Copilot-related request bodies (via JSON parsing) and parsed response JSON, then can export the full captured dataset (including responses) to the clipboard through haiDump(). Additional helper functions fetch and scan all loaded JS bundles for keywords and reveal hidden UI elements, further supporting surveillance and mapping of application behavior. Overall, the behavior strongly matches unauthorized data collection/exfiltration patterns rather than benign debugging.

In this fragment, the Bash file functions purely as an authenticated test orchestrator: it uses bearer tokens to query HackerOne’s GraphQL endpoint for introspection and then delegates all higher-risk behaviors (IDOR/OAuth/SSRF/race/reset testing) to external local Python helper scripts, capturing their outputs to a log file. There are no hardcoded credentials, no visible obfuscated payloads, and no direct evidence of malware behavior within this wrapper itself. The primary security concern is that it operates with high-privilege tokens and creates a durable record of tool outputs; additionally, the actual maliciousness/intent cannot be confirmed without reviewing the delegated Python scripts, so risk is assessed as moderate due to potential misuse and unknown code in external tooling.

This fragment strongly indicates a recon-to-attack credential/authorization spraying toolkit (HTTP form and OAuth password-grant) with lockout-aware behavior and GraphQL-based auditing/hunting. No actual code implementation is provided in the excerpt, so specifics about network destinations, data handling, persistence, or stealth cannot be confirmed; nevertheless, the intent signals are severe enough that the dependency should be treated as highly suspicious/malicious until verified against a legitimate, explicitly authorized security-testing use case.

This module is an offensive, automation-focused WAF/authorization bypass tool. Its documented behavior—adaptive WAF/vendor fingerprinting, bypass-request mutation (headers/path/method/content-type), block-baseline calibration and scoring, and extraction/logging of WAF incident identifiers—materially enables unauthorized probing and likely follow-on exploitation. The inclusion of payload encoding/mutation and multipart parser-confusion bypass tooling further increases abuse potential. As a supply-chain dependency, it would represent a high security risk due to its evasion/exploitation orientation and conditional delegation to an external bypass package. No clear obfuscation is evident from the provided fragment, but the threat is intent and capability rather than concealment.

The fragment is highly abuse-enabling malicious guidance for constructing multi-stage exploit chains. While it is not executable code, it provides concrete steps and decision logic to achieve severe outcomes such as OAuth authorization-code theft leading to account takeover, SSRF-based cloud/IAM credential harvesting, XSS→CSRF admin privilege escalation, secret extraction from exposed web assets, and prompt-injection-driven data exfiltration. Treat any inclusion in a software supply chain as a high security risk artifact.

This artifact is an explicit offensive exploitation “chain builder” that instructs an agent to actively validate and combine web vulnerabilities into high-impact compromise chains (OAuth ATO/code theft, SSRF→cloud metadata credential access, stored XSS→admin priv-esc/automation, and other weaponized patterns). It includes operational constraints (confirm/prove chains, time-box tests) and OOB validation guidance that materially enables real-world exploitation. No code execution is present in the snippet, but the provided content functions as an actionable agent prompt/config and is therefore high risk for supply-chain inclusion.

The code is primarily a local JSON case-recording utility and shows no evidence of intentional malware. It has a moderate path traversal and arbitrary-file-overwrite risk when write_research_case() receives attacker-controlled case dictionaries, because case_id is not restricted to a safe basename. The builder-generated IDs are comparatively safe, but direct callers can bypass that assumption. Validate case_id with a strict basename pattern, reject path separators and '..', and preferably resolve the final path and verify it remains under the configured directory.

This is a deliberately vulnerable HTTP test server, not evidence of malware. It demonstrates an open redirect, flag and example-credential exposure, weak authorization, unsafe JSON interpolation, and a bounded delay-based injection simulation. Do not expose it to untrusted networks or use real secrets.

The provided fragment is documentation for a recon utility that enumerates open non-HTTP services using external scanners (active probing via naabu and optional passive enrichment via smap/Shodan) and then highlights attack-surface ports relevant to follow-on compromise. No malicious payload or execution logic is shown here, so malware cannot be confirmed from this fragment alone. However, the explicit exploitation/pivot guidance (e.g., webshell/container escape/dumping concepts) makes the tool security-sensitive and potentially high-risk for misuse if included in untrusted environments. Review the actual implementation files to verify that behavior is limited to recon/port enumeration, includes appropriate safeguards, and does not perform exploitation beyond intended scope.

This package’s provided content is high-risk in intent and capability: it is designed to forge and manipulate JWTs (alg=none, RS256→HS256 confusion, and HS256 secret cracking via a wordlist) and to test exploitation by replaying forged tokens for privilege escalation/auth bypass. No executable code is shown, so additional supply-chain malware behaviors (e.g., data exfiltration or backdoors) cannot be confirmed from this snippet alone, but the documented functionality is strongly consistent with offensive exploitation tooling and should be treated as security-sensitive/dual-use with strict usage controls.

The provided material is a behavioral description of a dual-use cloud reconnaissance workflow, not the executable implementation. No direct malware indicators (e.g., credential theft, backdoors, obfuscated payloads, or covert exfiltration code) can be verified from this fragment. The primary concern is the tool’s explicit capability to enumerate public storage and infer potential Cloudflare-bypassing origin IPs, which can materially facilitate unauthorized targeting if misused. A proper review requires the actual script/code to confirm absence of unsafe operations (credential handling, remote exfiltration, dynamic execution) and to validate scope/authorization guardrails.