hunt-api-misconfig

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 1.00). Contains explicit attacker-controlled domains (https://evil.com and https://evil/spec.json) used as examples for hosting malicious OpenAPI specs and as a malicious origin for CORS/configUrl attacks, which are high-risk vectors for distributing malicious payloads or initiating authenticated abuse.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The document explicitly contains step‑by‑step offensive techniques and payloads (JWT forging, mass assignment, prototype pollution leading to RCE, CORS/Swagger abuse, OData exfiltration) that enable deliberate data theft and remote compromise.