redirect-forge

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 1.00). Yes — many of the listed URLs point to attacker-controlled or OOB domains (evil.com, phishing pages, burpcollaborator/interactsh IDs) or direct malicious resources (e.g., analytics.evil.com/track.js, evil.com/malicious.js) and are classic vectors for delivering malware, token theft, or phishing.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This repository contains an explicit offensive open-redirect exploitation playbook and tools with step‑by‑step instructions and code to capture OAuth auth codes/tokens, host a token catcher, and exfiltrate credentials — clearly intended for malicious abuse.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The runtime workflow involves actively probing and fuzzing user-supplied target URLs/parameters by substituting payloads and sending HTTP requests (e.g., scripts/redirect_probe.py reads -l targets.txt and -p references/payloads.txt, then checks the Location header for evil.com).