casperpro

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly captures, prints, and injects authentication tokens, cookies, and passwords into curl commands and logs (e.g., extracting TOKEN from mitmproxy output and using "-H 'Authorization: $TOKEN'" or hardcoding/printing JWTs), which requires the LLM/agent to handle and emit secret values verbatim, creating an exfiltration risk.

---

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 1.00). The set includes clear high-risk items — attacker/typosquatting domains (e.g., evil.com, target.com.evil.com), many internal/metadata/localhost endpoints (SSRF/credential-exposure targets), and direct install/download links (curl|sh install script and GitHub release zips for binaries) that are commonly used to distribute malware or abuse trust, so the collection should be treated as suspicious.

---

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This skill package contains explicit, reusable tooling for capturing and exfiltrating authentication tokens/cookies, forging and manipulating JWTs to escalate privileges, on-the-fly request/response modification (including privilege escalation and header removal), Windows Defender exclusion instructions, and other active exploitation modules — all patterns that enable deliberate credential theft, data exfiltration, authorization bypass, and evasive persistence/coverage, making it a high-risk dual-use offensive toolkit that can be abused outside authorized testing.

---

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The required runtime workflow ingests outsider-authored free text from the target application’s HTTP responses and request bodies via the mitmproxy capture hooks (request()/response() calling flow.request.get_text() / flow.response.get_text() and writing them into JSON files), and those captured prose bodies are then used for analysis/reporting that is fed back into the agent’s LLM context.

---

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill requires the "uv" package manager and instructs running a remote install script via "curl -LsSf https://astral.sh/uv/install.sh | sh" (present in multiple install/CI steps), which fetches and executes remote code as a required setup step.

---

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill includes explicit privileged/system‑level actions—e.g., sudo apt install commands, instructions to modify Windows Defender exclusions (run as Administrator), and other OS configuration changes—effectively asking the agent to perform privileged operations and bypass security controls on the host.