hunt-laravel

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). The required workflow fetches target-hosted pages, Telescope/Horizon API responses, and the Laravel log, which can contain attacker-influenced request data, but the agent must actively request these specific endpoints, so this is low exposure rather than medium.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (medium risk: 0.30). The skill's only inbound operational dependency is a setup-time git clone of an unpinned GitHub repository (ambionics/laravel-ignition-rce) whose exploit.php is then executed, and since that repo is published by a security research firm's project rather than a recognized first-party vendor or an immutably pinned artifact, it is common/reputable unofficial and therefore medium.