deserialization-java

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt explicitly requires the agent to report "New credentials or tokens found" in its return summary and save evidence files (which may contain secrets), and it includes concrete secret-like values (default ViewState keys), so the LLM would be expected to handle and output secret values verbatim.

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 1.00). These URLs are highly suspicious: they reference attacker-controlled hosts serving direct executables/scripts (payload.exe, shell.sh), JMX/EJB invoker and CLI endpoints used for remote deserialization/JNDI attacks, and OAST/Collaborator callback domains—classic indicators of exploit-driven malware distribution.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This document is an explicit, step-by-step exploitation playbook that instructs how to achieve remote code execution (reverse shells, remote class loading), perform data exfiltration (DNS/JNDI callbacks, leaking environment/AWS secrets), and use attacker-controlled infrastructure—i.e., clearly malicious offensive tooling.

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I inspected the skill content for literal credentials. I found three base64-encoded default ViewState keys under "MyFaces with default/weak encryption keys". These are not placeholders (they are explicit key values) and can be used to decrypt/forge ViewState, so they are usable secrets:
• NzY1NDMyMTA3NjU0MzIxMA== (base64 → "7654321076543210")
• NzY1NDMyMTA= (base64 → "76543210")
• MDEyMzQ1Njc4OTAxMjM0NTY3ODkwMTIz (base64 → "012345678901234567890123")

All other suspicious-looking tokens in the document are clearly placeholders or illustrative (e.g., COLLABORATOR.oastify.com, ATTACKER, ID, example curl/commands) and are ignored per the rules.