exploiting-api-injection-vulnerabilities

SUSPICIOUS/HIGH-RISK offensive security skill. Its behavior is coherent with its stated purpose, so it is not deceptive malware, but it equips an AI agent to perform active exploitation, SSRF against internal/metadata services, and command-injection testing with real-world impact. The scanner's backtick alert is benign documentation context, but the overall skill remains high security risk due to offensive-agent enablement.

This module is a dual-use, active injection-testing/probing utility that sends explicit SQL/NoSQL/command injection payloads to an attacker-supplied API endpoint and uses error-message matching plus response-size/time anomalies to flag likely vulnerabilities. It does not show stealth, obfuscated payload delivery, credential theft, persistence, or exfiltration within the provided snippet; however, it is inherently high-risk due to its offensive request capability and the use of verify=False (TLS validation disabled). The security impact is primarily misuse/offensive probing rather than autonomous malware behavior.