hunt-agent-mcp-exposure

High-risk dual-use security skill. It provides executable and procedural guidance for bypassing MCP access controls, reading protected data, and testing OAuth/SSRF exploit paths. No external installer, local credential collection, or confirmed exfiltration behavior is evident; use should be limited to explicitly authorized assessments.

This is documentation of a potential authentication bypass, not executable code or evidence of npm package malware. If the described endpoint grants protected artifacts solely after a caller echoes a nonce, the issue is high severity because unauthenticated callers may access protected data. The supplied content does not verify that any real service implements this behavior; the example domain is target[.]com.