bugbounty-reporter

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The skill instructs the agent to include "exact ... parameter, and value" and to provide curl/HTTP requests for PoCs, which can force embedding sensitive tokens or credentials verbatim (even though it asks to redact/truncate), creating an exfiltration risk.

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). Yes — multiple URLs point to attacker-controlled hosts, typosquatted domains, and open-redirects to internal metadata endpoints (SSRF/XXE patterns), which are high-risk vectors for distributing malware, credential exfiltration, or OOB payload delivery.