race-condition

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt explicitly instructs the agent to include session cookies, tokens, and "new credentials or tokens found" in its return summary and shows examples embedding session IDs/TOKEN values directly into HTTP headers/requests, which requires verbatim handling of secrets.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This document is a high-risk offensive toolkit that gives step-by-step methods to exploit race conditions for double-spends, coupon abuse, account takeover (password/2FA token reuse), rate-limit bypassing, and automated credential/token abuse—techniques that enable fraud and unauthorized access if used without authorization.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is explicitly designed to exploit race conditions against financial endpoints. It contains concrete, targeted instructions and example payloads for actions that move money or credit user accounts (e.g., "Balance transfer/payment" with a POST /api/transfer example to cause double-spend/overdraw, coupon/gift-card redemption that applies duplicate credit, and verification steps checking sender/recipient balances). Although it doesn't name third-party gateways, its primary and explicit focus includes sending transactional requests that alter financial state (debits/credits), i.e., direct financial execution.