autopilot

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt explicitly instructs agents to search for "leaked endpoints, secrets, configs" and to record/include raw recon/evidence and PoC artifacts (files, curl commands, findings) in brain/reports without any redaction rules, which forces the LLM to surface secret values verbatim in outputs.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). This orchestration is explicitly designed to perform exhaustive, automated offensive testing with built-in evasion and data-exfiltration techniques (e.g., payloads that fetch document.cookie to attacker hosts like c.oast.fun / evil.tld, use of attacker redirect targets, GitHub/mobile decompile secret harvesting, origin-IP probing to bypass protections, and a "stealth" camofox browser) and an "insatiable" autonomous mode that suppresses human control—these elements together present high risk of deliberate malicious abuse and credential/data exfiltration if run outside strict authorized scope.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 1.00). The skill explicitly fetches and ingests arbitrary public web content (e.g., recon public-archive sweep into recon/urlscan-cdx.json, GitHub code search recon/github-code.json, and the Surface Probe A–I curl commands that save HTML/headers from https://$TARGET/ into evidence/) and then uses those findings to seed hunter prompts, dispatch agents, and decide next actions, so untrusted third-party content can directly influence tool use and behavior.