api-fuzzing-bug-bounty

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This document contains explicit, actionable offensive techniques (SQLi, command injection, SSRF/XXE, IDOR, credential/PII extraction and remote data exfiltration) that enable unauthorized access and abuse despite a stated “authorized use” caveat.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). SKILL.md describes an API fuzzing workflow where the agent targets attacker-supplied endpoints/URLs (e.g., “kr scan https://target.com” and GraphQL introspection/exploitation requests), meaning outsider-provided free text (the target URL/parameters/queries) can directly drive runtime HTTP request content.