webapp-pentesting

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill repeatedly instructs embedding authentication tokens, cookies, JWTs and session values directly into curl/sqlmap/ffuf/ffuf commands and to record request/response evidence, which requires handling and outputting secret values verbatim (exfiltration risk).

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). Suspicious — the list mixes attacker-controlled/typosquatted domains (evil.com, ATTACKER_SERVER placeholder, github.com0compenhagen), untrusted GitHub repos, and internal/metadata/Kubernetes endpoints (169.254.169.254, kubernetes.default.svc) that can be abused (SSRF, payload hosting, or redirect to malicious downloads) even though there are no explicit .exe/.msi links; overall the presence of attacker placeholders and typosquats indicates a high potential for malware distribution or exploitation.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The document contains explicit, actionable offensive techniques (SSRF to cloud metadata for credential theft, SQLi→FILE/OUTFILE and gopher/Redis payloads to write cron/webshells, web shell upload & pivoting, credential harvesting and cracking workflows, stealth evasion and request-smuggling tactics) that enable data exfiltration, RCE, persistence, and supply‑chain/host‑header poisoning — all high-risk patterns readily usable as backdoors or for system compromise.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 1.00). The skill's SKILL.md explicitly directs the agent to fetch and analyze arbitrary target web pages and JavaScript bundles (e.g., "Download and analyze JavaScript bundles" and the Playwright flows that navigate to https://TARGET and fetch main.js), so it ingests untrusted third‑party content and uses it to drive tool actions and testing decisions.