hunt-source-leak

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill instructs the agent to fetch, extract, grep, and print files (e.g., .env, source maps, .git history, JS bundles) and explicitly greps/decodes for API keys, tokens, and passwords, which will surface secret values that the agent would need to include verbatim in outputs or reports.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This document is an explicit offensive reconnaissance playbook that instructs how to discover, reconstruct, and exfiltrate sensitive source/build artifacts (source maps, .env, .git, swagger, webpack chunks) and harvest credentials for unauthorized access.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The required workflow performs outsider-target recon by fetching attacker-controlled website contents like /swagger.json//openapi.json and downloading/parsing .js.map files (which may contain arbitrary free text such as source code/secrets) before analysis.