xss-hunter

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill includes command-line examples that pass bearer tokens and session cookies as literal arguments (e.g., --token "eyJ..." and --cookie "session=abc"), which would require the LLM to include secret values verbatim in generated commands or code.

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). Multiple URLs point to attacker-controlled or placeholder callback hosts and remote scripts (attacker.com, your-collaborator.net, whitelisted-cdn.com and YOUR_URL / YOUR_IP placeholders) that are clearly intended for exfiltration or loading remote payloads — these are suspicious and could be used to deliver or execute malicious code.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The content contains explicit XSS exploitation payloads and instructions for stealing sensitive data (cookie theft, credential harvesting, keylogging, internal scanning) and for exfiltrating it to attacker-controlled endpoints, indicating deliberate malicious/abusive behavior.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In scripts/xss_agent.py, the agent performs runtime GET/POST requests to user-supplied base_url/--params and then ingests the resulting response body text to detect and confirm reflected/stored XSS (e.g., requests.get(canary_url) and resp.text / display_resp.text), which means an outsider can supply free text via the target’s request-handling endpoints that the workflow then reads.