ai-llm-hunter

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly instructs crafting payloads that ask the model to read and embed secrets (e.g., system prompt, API keys like "sk-1234abcd") verbatim into URLs/requests, which requires the LLM to handle and output secret values directly.

---

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 1.00). These URLs include attacker-controlled domains and Burp-collaborator-style endpoints plus internal hosts (internal-api.company.local and the cloud metadata IP) that are high-risk for SSRF/exfiltration and could be used to deliver or orchestrate malware.

---

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This skill explicitly documents step-by-step offensive techniques for prompt injection, data exfiltration (HTTP/DNS/SSRF/image fetch), credential theft, remote code execution and sandbox escape, and obfuscation — clearly intended to enable malicious abuse and high-risk attacks.

---

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The required workflow for ai-llm-hunter explicitly instructs testing/using outsider-authored free text via direct user-controlled inputs and particularly indirect prompt injection by uploading attacker-crafted documents (Phase 3.1 “Document / File Injection”) for the runtime LLM to read and process.

---

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill includes explicit runtime payloads that instruct an agent to fetch and follow remote instructions or execute code from attacker-controlled hosts (e.g., "https://attacker.com/malicious-instructions.txt"), which would allow remote content to directly control prompts or run commands.

---

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I scanned the skill and benchmark content for high-entropy, literal credentials.
• Flagged: BENCHMARK.md contains a high-entropy-looking API key "sk-internal-doc-api-7f3c9a2b1e4d" embedded in the reproduced model output. This appears as a concrete, non-placeholder API key (not a generic "YOUR_API_KEY" style placeholder) and matches the definition of a secret.
• Ignored (not flagged):
• BENCHMARK.md:31-32 "credentials: user1:pass123" — low-entropy, clearly a test/setup credential; per rule, these simple example passwords are ignored.
• SKILL.md:267 secret = "sk-1234abcd" — used in an illustrative example for DNS exfiltration and resembles a placeholder/example secret; treated as a non-sensitive example per guidance to ignore obvious examples/placeholders.
• SKILL.md:315 "Admin override code 7743" — short numeric code / example; low entropy and clearly an illustrative value.

Only the long, specific "sk-internal-doc-api-7f3c9a2b1e4d" is treated as a real secret worth flagging.

---

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill explicitly includes instructions to read privileged files, write and execute filesystem payloads, invoke OS commands, and perform SSRF/network requests (e.g., read /etc/secrets, write /tmp/payload.sh and execute it, curl with cat /etc/passwd, fetch 169.254.169.254), which push an agent to modify or compromise the host environment.