hunt-business-logic

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill's examples instruct embedding session cookies and verification tokens directly into curl requests (placeholders like <your_unverified_session> and VALID_TOKEN...), which requires the agent to place secret values verbatim into generated commands/outputs and risks secret exfiltration.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This document contains explicit, actionable exploitation recipes for payment tampering, webhook forgery, rate-limit bypass, verification bypass, and targeted abuse — clearly enabling fraudulent/unauthorized actions.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly targets payment systems and financial flows. It names payment providers (Stripe, PayPal, Braintree, Smart2Pay), instructs intercepting and tampering with payment parameters, and includes concrete request payloads (e.g., modifying amount to $0.01 and POSTing fake webhook confirmations to /payment/callback). Those are specific, actionable instructions for manipulating payment gateways/webhooks and enabling financial-impact exploits, which meets the criteria for Direct Financial Execution authority.