xxe

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt explicitly instructs the agent to exfiltrate and record sensitive data (e.g., /home/*/.ssh/id_rsa, IMDS AWS credentials) and to include "new credentials or tokens found" in the return summary and saved evidence, which requires outputting secret values verbatim.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This document is an explicit, high-risk XXE exploitation playbook that provides concrete payloads and operational steps to read local files, perform SSRF and out‑of‑band exfiltration, capture credentials (including AWS IMDS and SSH keys), and achieve remote code execution or NTLM capture — clearly intended for offensive abuse.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.65). The skill’s runtime workflow is a penetration-testing XXE procedure that ingests attacker-supplied XML payloads (including external entity SYSTEM identifiers and DTD URLs) into the target application; those payloads are outsider-authored free text (the tester/attacker’s content) that can be reflected back into the agent’s LLM context via the evidence/logging outputs.