performing-ssrf-vulnerability-exploitation

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly instructs fetching cloud metadata (169.254.169.254) and to "analyze responses" and "generate a vulnerability assessment report" where the example states that AWS AccessKeyId/SecretAccessKey in responses confirm SSRF, which requires the agent to read and potentially include secret credential values verbatim—an exfiltration risk.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This repository contains explicit SSRF exploitation tooling that probes cloud metadata endpoints, searches for access tokens/keys, performs internal port scanning, and uses bypass/redirect techniques—capabilities that enable credential theft, data exfiltration, and internal network reconnaissance.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The runtime workflow in scripts/agent.py sends outsider-controlled free-text (e.g., --target-url which includes a user-provided url= parameter value) through test_ssrf_payload() using requests.get, then ingests the fetched response body (resp.text/resp.content) into its analysis and report.