hunt-deserialization

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 1.00). These URLs point to offensive exploit tool repositories and a direct downloadable JAR (ysoserial) on GitHub—known vectors for delivering deserialization/RCE payloads and thus represent high-risk, potentially malicious download sources.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This document is an explicit, step‑by‑step offensive playbook for achieving remote code execution via insecure deserialization (ysoserial, phpggc, pickle, ViewState, JNDI/Log4Shell, etc.), including payload generation, OOB callbacks, and cloning exploit toolkits — clearly malicious and intended for abuse.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly downloads and executes remote tooling during runtime (wget https://github.com/frohoff/ysoserial/releases/latest/download/ysoserial-all.jar and git clone https://github.com/ambionics/phpggc and git clone https://github.com/pimps/JNDI-Exploit-Kit), so it relies on fetching and running external code as required dependencies.