hunt-session

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly instructs capturing real session tokens/refresh tokens/JWTs and echoing or inlining them into curl requests (e.g. -H "Cookie: $A", refresh_token JSON bodies, JWT variable use), which requires the LLM/agent to handle and output secret values verbatim — an exfiltration risk.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The document contains explicit, actionable offensive instructions to forcibly set/preregister session IDs, capture and replay session cookies and JWTs, and abuse refresh-token rotation—techniques clearly enabling account takeover and credential theft.