bug-bounty

CRITICAL E004: Prompt injection detected in skill instructions.

• Potential prompt injection detected (critical risk: 1.00). The skill contains explicit, actionable exploit instructions and payloads (SSRF to cloud metadata and IAM credential exfiltration, RCE/SSTI payloads, OAuth open-redirect→code-theft chains, data-exfiltration payloads, etc.) that clearly enable secret exfiltration and account takeover.

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). This skill repeatedly instructs producing "exact" / copy-pasteable HTTP requests and shows examples embedding session tokens/Authorization headers (e.g., Cookie: session=TOKEN, Bearer $TOKEN), which requires the LLM to handle or output secret values verbatim.

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (medium risk: 0.30). The README explicitly instructs users to download and run a Windows installer ZIP from raw.githubusercontent.com (https://raw.githubusercontent.com/Mikacr1138/claude-bug-bounty/main/skills/triage-validation/claude_bug_bounty_v3.6.zip) — a direct executable distribution hosted under a different GitHub user than other repo references, with no checksum/signature or provenance, which is a suspicious download source.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The validator agent takes a user-described finding (free text) as input and decides PASS/KILL/DOWNGRADE based on that text without showing any constrained, item-selected ingest step (only described “finding” is used for the gate logic), creating indirect prompt-injection risk from outsider-authored descriptions.

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00).
• Flagged: I found a literal Authorization header containing a token (used in curl -H "Authorization: 15e77cfb-2300-426a-b8c3-fbfbf0ab17d4"). This is an embedded credential (API token) in example code/automation and is not a placeholder like YOUR_API_KEY — treat as a real secret and rotate/remove it from the repo. Locations below point to the exact curl uses.
• Ignored: The potential match "-----BEGIN OPENSSH PRIVATE KEY-----" appears only as a regex/pattern in docs/payloads.md (a detection example), not as a PEM block with base64 key material. It is a documentation pattern/placeholder and not an actual private key, so I did NOT flag it.