hunt-cors

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 1.00). These URLs are attacker-controlled or typosquatting origins and crafted origin payloads (e.g., evil.com, eviltarget.com, x.target.com.evil.com, various backtick/encoded variants) used in CORS/exploit testing rather than official vendors or CDNs, and therefore represent suspicious sources that could be used to host or distribute malware.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). Dual-use offensive security guidance that includes explicit, actionable techniques for credentialed cross-origin reads and out-of-band exfiltration (browser PoCs with OOB callbacks), which can be directly abused to steal session tokens, CSRF tokens, and other sensitive data.