hunt-oauth

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). Yes — the list mixes many clearly attacker-controlled or typosquatted hosts (attacker.com, attacker.example, target.com.attacker.com, IDN homographs like tаrget.com), userinfo and CRLF/encoding redirect tricks, localhost/@-style obfuscations, and direct jwks/callback endpoints that are commonly used in token-exfiltration and malware/credential-distribution chains, so downloading/executing anything from this set is high-risk even though a few entries are benign vendor/blog URLs.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The document contains detailed, actionable exploitation techniques (payloads, PoCs, attack chains) for stealing tokens, performing account takeovers, inducing RCE, and enabling supply‑chain compromise — material that can be directly misused for malicious data exfiltration and remote compromise.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The SKILL.md explicitly instructs the agent/hunter to fetch and analyze public third‑party web content (e.g., /.well-known endpoints, OAuth callback pages, third‑party JS/analytics/chat widgets like GTM/Hotjar/Intercom, MCP tool descriptions and support-case bodies) as part of its workflow, meaning untrusted external content is read and could materially influence tool use or enable indirect prompt-injection.