oauth-attacks

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt instructs the agent to extract authorization codes, access/refresh/ID tokens and client secrets from browser cookies/redirects and to include or log those values verbatim in curl requests, evidence files, and the return summary, which requires the LLM to handle and output secrets directly.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This document is an explicit offensive guide describing step-by-step techniques to steal OAuth authorization codes/tokens, perform redirect_uri and state bypasses, exfiltrate tokens/claims to attacker-controlled endpoints (including postMessage fetch examples), abuse dynamic registration to trigger SSRF (cloud metadata access), and achieve account takeover — i.e., deliberate malicious/abusive behavior aimed at credential/token theft and remote compromise.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.65). The skill’s runtime workflow includes “Web Interaction” using browser_open/browser_evaluate to drive OAuth flows and extract tokens/codes from redirect chains and URL fragments; those browser interactions necessarily ingest attacker-controlled redirect/callback content (e.g., attacker domain pages/redirect responses) into the LLM context via extracted readable text/URLs, which is outsider-authored free text.