hpp-hunter

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). This content provides explicit, automated instructions and payloads to exploit HTTP Parameter Pollution (including OAuth redirect_uri manipulation, SSRF to metadata endpoints, WAF bypass with split SQLi/XSS, and payment/role overrides), which are high-risk offensive techniques readily actionable for abuse.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In scripts/hpp_agent.py, the runtime workflow directly ingests outsider-supplied CLI arguments --url/--param/--value and then performs HTTP requests (GET/POST) that read the target’s response body (resp.text) and compare it, enabling indirect prompt injection via attacker-controlled endpoint content.