hunt-xss

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The skill document contains numerous explicit, step-by-step, and easily reproducible exploitation techniques (including concrete payloads that exfiltrate cookies/tokens to attacker-controlled domains, create backdoor admin accounts via XSS, abuse OAuth returnTo, postMessage origin-bypass recipes, and supply-chain attack vectors), which are highly actionable and can be directly used for unauthorized data exfiltration and account takeover.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The SKILL.md explicitly instructs the agent to fetch and inspect open/public third‑party web content (live target pages, exposed package.json/SBOM endpoints, CDN script tags, and external advisories like mizu.re and GitHub security advisories) and to use that untrusted, user‑generated content to decide which exploits/payloads to run, which clearly exposes the agent to indirect prompt‑injection from third‑party sources.