exploiting-websocket-vulnerabilities

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The prompt contains examples that embed session cookies/tokens directly into command-line headers and code (e.g., -H "Cookie: session=valid_token" and extra_headers={"Cookie": "session=valid_token"}), which is an insecure pattern that requires handling/outputting secret values verbatim.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The document contains explicit proof-of-concept code and instructions for data exfiltration (fetch to attacker-controlled endpoint), credential/session theft and replay, message injection enabling SQLi/command/path traversal, and guidance to abuse WebSocket connections for unauthorized access and DoS—behaviors that constitute deliberate malicious activity if used outside an authorized test.