bug-bounty

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). Several URLs are direct install/download endpoints and GitHub release/raw-script links from third-party or small accounts (raw.githubusercontent, releases/download, unknown domains like kimchi.dev) which are common vectors for malware or supply-chain compromise and should be treated as suspicious until verified.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). The repo includes explicit, automated credential-attack tooling (wordlist/osint/breach-check + a spray orchestration flow) and autopilot/auth-aware agents that can load and reuse auth sessions — this is high-risk dual-use functionality that enables credential theft and live password spraying if misused.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill includes installation commands that fetch and install remote skill content which the agent will load at runtime (git clone https://github.com/shuvonsec/claude-bug-bounty.git and curl https://raw.githubusercontent.com/shuvonsec/claude-bug-bounty/main/SKILL.md), meaning those URLs provide content that directly controls the agent's prompts/skill behavior.