ssrf

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The content includes explicit PoC code, concrete payloads (including cloud metadata endpoints) and IP/encoding bypass techniques that directly enable SSRF-based data exfiltration and credential theft.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill's SKILL.md and references/poc-skeleton.md explicitly instruct testing endpoints that fetch user-supplied URLs (e.g., webhook handlers, URL preview/import-from-URL features) and include PoC payloads that post arbitrary external URLs such as attacker-controlled domains and cloud metadata endpoints (references/poc-skeleton.md), so the agent/workflow will ingest and act on untrusted third-party content.