hunt-laravel

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly retrieves secrets (curl /.env), assigns/echoes APP_KEY and then passes that APP_KEY verbatim into tooling/CLI arguments to forge cookies, which requires the LLM/agent to handle and output secret values directly.

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 1.00). The list includes a direct git clone of an exploit repository (https://github.com/ambionics/laravel-ignition-rce) and commands to execute its code—an explicit high-risk download/source of exploit/malware; the remaining URLs are target application endpoints (not download hosts).

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This skill contains explicit, actionable exploitation instructions (unauthenticated RCE, .env/APP_KEY exfiltration, cookie forging, mass-assignment privilege escalation, and API scraping of sensitive logs/tokens), indicating deliberate malicious intent and high-risk abuse.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill clones and executes remote code at runtime from https://github.com/ambionics/laravel-ignition-rce (git clone followed by running php /tmp/laravel-rce/exploit.php), which fetches and runs external code.