Broken Authentication Testing

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill includes explicit examples and steps that capture and then embed sensitive values verbatim (passwords, session cookies, JWTs, reset tokens, test account credentials) into requests/commands, requiring the LLM to handle secrets directly and therefore posing high exfiltration risk.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This document provides detailed, actionable instructions for account takeover and authentication bypass techniques (brute force, credential stuffing, session fixation, JWT manipulation, host-header injection, OTP brute-force) plus evasion tactics—presenting a high risk for malicious abuse.