acidrain-security-testing

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill contains code that extracts and logs cookies and an XSS payload that exfiltrates document.cookie, which would cause secret/session values to be read and emitted verbatim by the agent or scripts.

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). The list contains an unvetted GitHub repository URL (an individual account cloning a security script hub) and an explicit attacker-controlled exfiltration URL (http://attacker.example.com/?c=) embedded in payloads, both of which are suspicious and could be used to distribute or facilitate malware/exfiltration.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). Contains explicit data-exfiltration and credential-theft patterns (an attacker-hosted cookie exfiltration payload plus utilities that extract/log cookies and full request data to disk), which indicate deliberate malicious-capability code despite "testing" framing.