bug-bounty

SUSPICIOUS/HIGH-RISK skill. Its stated purpose is coherent with its capabilities, but that purpose is to equip an AI agent for offensive security operations against live targets, including exploit development, prompt extraction testing, OOB callbacks, and broad command execution. The install sources are mostly legitimate but unpinned and partly personal-repo based. This is not confirmed malware, but it is a high-risk offensive capability set inappropriate for routine agent use.

SUSPICIOUS/HIGH-RISK skill. Its purpose and content are internally consistent as an exploit reference, but that purpose is to give an AI agent offensive security capabilities against arbitrary external systems. There is no clear credential theft or hidden malware behavior in the skill itself, yet the operational risk is high because it materially enables scanning, exploitation, and exfiltration workflows.

SUSPICIOUS: the skill is coherent with its stated purpose, but that purpose is to give an AI agent offensive smart-contract auditing and exploit-PoC capability. Dependency provenance is mostly consistent and data flows are direct to the configured RPC provider, yet the combination of exploit tooling plus credentialed RPC use makes it high security risk even without clear malware behavior.

The code is an active, token-driven security testing/exploitation script for HackerOne that probes for IDOR and related access control flaws. It performs authenticated cross-account reads, prints sensitive account data upon suspected findings, and includes GraphQL mutations that could change report state and send invitations—capabilities that are clearly offensive in nature. There is no conventional malware behavior (no obfuscation, no persistence, no local system compromise), but the tool’s design meaningfully supports unauthorized access if misused. Overall, this should be treated as high-risk tooling rather than benign library code.

This skill is coherent with its stated purpose as a Web3 security research and audit methodology guide, but it equips an AI agent with offensive security workflows and includes commands to install tools, clone PoC repos, and run analysis/exploit tests. No clear credential theft, stealth, or malicious exfiltration is present; the main risk is enabling high-impact security testing and executing third-party research code.

The provided file is best characterized as an offensive WebSocket testing/exploitation harness with explicit CSWSH-style credential abuse and direct exfiltration of WebSocket-received data to an attacker-controlled domain. The code contains multiple hardcoded attack probes (authz/authn bypass testing, IDOR via victim identifiers, XSS/SQLi-like payloads, and admin action attempts). There is no evidence of obfuscation; the suspiciousness is in the explicit malicious behavior and payloads. If this behavior appears in a dependency that can be executed automatically during install or runtime, it should be treated as a critical supply-chain red flag and removed/reviewed urgently.

SUSPICIOUS/HIGH-RISK skill. Its footprint matches its stated purpose, but that purpose is offensive web recon for arbitrary targets, which is unsafe for an AI agent. The strongest concrete issue is the embedded ProjectDiscovery API key; otherwise the main risk comes from enabling automated scanning, fuzzing, and monitoring rather than hidden exfiltration or deceptive installers.

SUSPICIOUS. The skill is internally consistent with an offensive-security purpose, but that purpose itself gives an AI agent high-risk exploit and exfiltration capability. It includes credential-theft and OOB exfil examples, references known capture infrastructure, and lightly references third-party tools with weak install provenance; high security risk, but not confirmed malware by itself.

This module is an active, authentication-dependent security testing/exploitation script. It takes real session cookies from the operator, fetches CSRF tokens, then performs multiple authenticated GraphQL mutations that can change report state/content and take actions such as disclosure requests, bounty awards, assignment, and email sharing if authorization checks fail—consistent with IDOR detection. The most notable implementation risk is disabling TLS certificate verification while transmitting sensitive cookies/CSRF tokens, which can expose the operator to MITM. There is no clear evidence of classic malware (backdoor/exfiltration), but the operational security risk is high because it is inherently attack-oriented and performs state-changing actions against a third-party service.

This code is a purpose-built offensive security/recon tool for Zendesk. It performs authenticated enumeration to test for IDOR/access-control weaknesses, attempts unauthenticated probing of endpoints, runs GraphQL introspection and writes the schema to disk, and creates webhooks pointing to internal/metadata IPs (a webhook SSRF-style test). Although it cleans up created webhooks and does not show classic malware behaviors (no command execution/backdoor), the functionality is clearly adversarial and can cause data exposure or SSRF impact if used against real systems. High supply-chain risk if included in an unsuspecting project.

No intrinsic malware or supply-chain sabotage is evident in this fragment because it is an instruction/workflow description rather than a package implementation. Still, it is explicitly a high-abuse, offensive vulnerability hunting playbook that can enable unauthorized exploitation (IDOR/auth bypass, SSRF with OOB/metadata probing, and GraphQL mutation attempts) if used without proper authorization and robust scope enforcement. Treat as high dual-use operational risk rather than confirmed malicious code.

This module is a high-risk prompt-injection payload builder that intentionally hides attacker-supplied or template-based instruction text inside invisible Unicode characters (U+2062/U+2064). It persistently writes both the covert payload and its cleartext form to disk, and the bundled templates explicitly target guardrail bypass, system-prompt extraction, severity manipulation, cross-tenant probing, tool enumeration, and exfiltration-style coercion. Although the snippet appears syntactically incomplete in the shown ATTACKS entries, the core steganographic generation mechanism and malicious objectives are clear. Do not use or distribute in a supply chain context without strong isolation and review of the full file.

This fragment is best characterized as a pentest-style offensive security testing CLI targeting authentication/OAuth behavior on a specific hardcoded domain. It performs outbound requests with attacker-controlled headers and (optionally) a user-supplied Bearer token, parses OAuth redirect parameters from server responses, and prints exploit-enabling test URLs and vulnerability indicators. There is no evidence of stealth, persistence, or direct data theft/exfiltration in the shown code; however, the exploit-oriented purpose and the inclusion of token/session probing makes it security-relevant. Confidence is reduced because the snippet appears syntactically incomplete (invalid print statement and truncated main invocation).

This code is not evidence of traditional malware or supply-chain sabotage (no obfuscation, persistence, or hidden payloads). However, it is an abuse-oriented authenticated security testing harness that automates concurrent 2FA OTP attempts and state-changing GraphQL/REST mutations (bounty acceptance, negative bounty validation, and email-change racing). If bundled into a dependency and executed with real tokens, it can enable unauthorized probing/exploitation patterns and should be treated as high-risk from a misuse standpoint. Review should focus on distribution/authorization controls and whether tokens/targets could be supplied or used unexpectedly.

This module is highly suspicious and likely malicious in intent: it is explicitly a “hidden/invisible prompt injection” payload generator/encoder that conceals attacker instructions using Unicode stealth and can output/save ready-to-deploy injection artifacts. While it does not perform network exfiltration itself, it includes exfiltration-oriented instructions/URLs and prompt-injection objectives (system prompt/tool extraction, cross-tenant probing, RAG poisoning, and response overriding). Treat it as high-risk supply-chain tooling; avoid using it in dependencies for production or untrusted environments.

SUSPICIOUS. The skill is not malware and shows no credential theft, installer abuse, or exfiltration, but it is an offensive security hunting guide for a live blockchain target. Its footprint is text-only and internally consistent, yet the purpose enables AI-assisted exploit research, which makes it higher-risk than ordinary documentation.

This module is high-risk client-side reconnaissance code. It installs hooks on fetch and XHR to capture and retain GraphQL/AI/Hai/Copilot-related request bodies (via JSON parsing) and parsed response JSON, then can export the full captured dataset (including responses) to the clipboard through haiDump(). Additional helper functions fetch and scan all loaded JS bundles for keywords and reveal hidden UI elements, further supporting surveillance and mapping of application behavior. Overall, the behavior strongly matches unauthorized data collection/exfiltration patterns rather than benign debugging.

This module is an offensive testing orchestrator that uses real bearer tokens to interact with HackerOne’s GraphQL API and then launches companion scanners/tetst tools. It contains a concrete high-risk coding anti-pattern (`eval $CMD`) where user-provided variables are interpolated into a shell command string without robust escaping, creating a command-injection risk on the machine running it. While this file itself shows no obvious self-contained malware/persistence/exfiltration to unrelated domains, the launcher’s nature plus delegation to other scripts and token handling makes it security-relevant and potentially harmful if tampered with or misused.

The fragment is highly abuse-enabling malicious guidance for constructing multi-stage exploit chains. While it is not executable code, it provides concrete steps and decision logic to achieve severe outcomes such as OAuth authorization-code theft leading to account takeover, SSRF-based cloud/IAM credential harvesting, XSS→CSRF admin privilege escalation, secret extraction from exposed web assets, and prompt-injection-driven data exfiltration. Treat any inclusion in a software supply chain as a high security risk artifact.

This dependency appears to be an attacker-oriented exploit-chain builder prompt/config intended to operationalize multi-hop web exploitation and maximize impact (OAuth ATO/code theft, cloud metadata credential harvesting, privilege escalation, secret harvesting, and RCE-oriented chains). While it is not runnable malware by itself, it is overtly weaponization-focused and represents a very high misuse risk if published or included as a dependency. It should be treated as unsafe and excluded from production use.

No direct malicious behavior (e.g., backdoors, exfiltration, or runtime payload logic) is evident in the provided script fragment. However, it performs high-impact supply-chain actions: it executes a network-fetched Homebrew installer directly via bash and installs multiple Go-based tools using unpinned `@latest` versions, and it updates nuclei templates without integrity verification. Treat this as a legitimate but security-sensitive installer that should be hardened (pin versions, verify signatures/checksums, and avoid direct curl-to-bash execution where possible) before use in sensitive environments.