security-arsenal

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 1.00). The list contains multiple attacker-controlled domains (attacker.com, attacker.burpcollaborator.net, evil.com, target.com.evil.com), open-redirects to cloud metadata, and many SSRF/loopback variants (169.254.169.254, metadata.google.internal, numeric/hex/octal localhost forms) that are commonly used to exfiltrate credentials, pivot to internal services, or deliver malicious payloads, so the set is high-risk.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This file is an explicit offensive payload library containing direct instructions and ready-to-use payloads for data exfiltration, credential theft, remote code execution, and multiple bypass techniques—clearly enabling deliberate malicious activity.