python-code-injection

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). This skill explicitly instructs the agent to read, save, and report discovered credentials/tokens (e.g., "Save discovered credentials", "Report in your return summary: credentials"), which requires including secret values verbatim in outputs—creating an exfiltration risk.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This document contains explicit, step‑by‑step offensive instructions and ready‑to‑use payloads for exploiting Python eval/exec/compile to achieve remote code execution, sandbox escape, credential/file exfiltration, reverse shells, and obfuscation/bypass techniques, indicating deliberate malicious exploitation intent.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The skill’s runtime workflow is about exploiting Python eval/exec injection, which necessarily involves sending attacker-controlled free-text payloads (outsider-authored) into the vulnerable parameter that the application then evaluates and reflects into the agent’s context via responses/tracebacks; this is an indirect prompt-injection path from outsider text into the LLM context.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). This skill explicitly instructs the agent to execute arbitrary Python that achieves OS command execution (popen/system/subprocess), read/write sensitive files, create reverse shells and write evidence to disk — all actions that change system state and can compromise the host or targets.