identity-provider-recon

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This skill explicitly documents and automates identity-fabric reconnaissance and pre-auth user-enumeration oracles (Microsoft GetCredentialType, Okta /api/v1/authn) and federation mapping calls that can be directly abused to build valid-account lists and feed subsequent credential-stuffing/password-spray attacks.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The skill’s required runtime workflow ingests outsider-authored free text at runtime primarily through user-provided prompts/seed domains that drive enumeration and oracle POSTs (e.g., candidate emails synthesized from provided “harvested” identity inputs), rather than limiting ingestion to first-party provider metadata/schema.