browser-exploitation

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 1.00). The URLs include exploit writeups, PoCs, GitHub repositories and scripts (e.g. chain_server.py, sandbox_escape.js, electron_audit.py, V8 exploit collections) plus staging/placeholder endpoints — all high-risk indicators that can be used to develop or deliver malware/exploits.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The repository is a deliberately offensive exploit toolset: it implements staged, targeted client-side RCE chains (engine → sandbox → OS), remote delivery and gating, persistence via ASAR/snapshot tampering, and tooling to find/weaponize broker/GPU logic bugs — all clear indicators of intentional malicious/backdoor behavior and supply‑chain abuse.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). This skill explicitly guides escalation from a browser JS-engine bug to native R/W and OS-sandbox escape, including spawning shells, writing files (app.asar tampering), and serving 1-click RCEs—actions that directly modify or commandeer the host state and enable remote code execution.