redteam-mindset

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly tells the agent to retrieve, decode, grep for, and "pass back" tokens, hardcoded API keys, JWTs and passwords (including an example payload), which requires the LLM to handle and output secret values verbatim—creating an exfiltration risk.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This skill contains explicit, actionable instructions for credential theft, data exfiltration (including OOB callbacks), remote code execution/webshell deployment, payload obfuscation, and operational tactics (IP rotation, unattended dumpers, paid captcha solving) that can be directly reused for malicious attacks.