command-injection

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt explicitly instructs the agent to extract credentials (e.g., .env values, SSH keys, DB connection strings), save them to evidence, and report them verbatim in return summaries and handoff commands, requiring the LLM to handle and output secrets directly.

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 1.00). Yes — several URLs point to attacker-controlled domains serving executable/script payloads (e.g., shell.php, payload.ps1) and callback endpoints commonly used for command-injection exfiltration, which are strong indicators of malicious distribution.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This document contains explicit, actionable instructions for exploiting OS command injection—including remote command execution, DNS/HTTP/time‑based data exfiltration, credential theft, webshell/backdoor installation, and pivoting—clearly enabling malicious abuse.