hunt-llm-ai

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt repeatedly instructs constructing outputs that embed or transmit sensitive data (e.g., markdown links, curl requests, base64/image-src exfil, and PoCs that print tokens/files), which requires the LLM to handle and output secret values verbatim for the described attacks.

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.85). Mixed: while many are legitimate security/research resources, the set contains multiple explicit attacker-controlled placeholders (attacker*, attacker.com, attacker/c2/exfil), internal/metadata endpoints (169.254.169.254, localhost:NNNN, target:11434/3000), and API/model-server endpoints that—although not direct .exe links—are high-risk vectors for malware distribution, command execution, or data exfiltration if interacted with or supplied payloads.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The skill content is a high-risk, dual‑use exploitation playbook: it contains explicit, weaponizable PoCs and step‑by‑step instructions for data exfiltration, credential theft, backdoor persistence and remote code execution across inference platforms, agents, and UI sinks.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 1.00). SKILL.md explicitly instructs fetching and ingesting untrusted public content (e.g., read_webpage/fetch_url, uploaded PDFs/CSVs, emails, calendar invites, arbitrary URLs and model-server endpoints) as part of the Step-by-Step Hunting Methodology and Attack Surface Signals, so third‑party inputs are read/interpreted and can drive tool use, enabling indirect prompt injection.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The prompt includes explicit malicious/privileged actions (os.system calls, reading/writing /etc files, creating cron jobs, pickle deserialization RCE, commands to exfiltrate tokens) that instruct an agent to execute code and modify system files, thus directly encouraging compromise of the host machine.