bug-bounty

SUSPICIOUS: the skill is internally consistent as an exploit arsenal, but that purpose itself gives an AI agent broad offensive security capability, including explicit exfiltration payloads and known OAST endpoints. There is little install-trust concern, but the operational risk is high because the skill materially enables exploitation, credential theft, and remote compromise.

SUSPICIOUS: the skill is internally consistent as a bug-bounty playbook, but its actual footprint is a high-risk offensive security capability for an AI agent. It enables reconnaissance, exploit development, prompt/system extraction, OOB callbacks, and real-world testing against external targets, with mutable third-party tool installs and broad exposure to untrusted content.

SUSPICIOUS: the skill is internally consistent as a bug bounty/offensive security guide, but its actual footprint gives an AI agent broad exploit capability, encourages use of sensitive auth tokens, processes untrusted external content with action-oriented tooling, and uses medium-trust installation paths. This is not confirmed malware, but it is a high-risk offensive skill.

SUSPICIOUS. The skill is internally consistent as an offensive web vulnerability reference, but that stated purpose is itself high risk for an AI agent: it teaches and operationalizes exploitation, uses live auth credentials, processes untrusted external content, and includes exfiltration and RCE chains. Little evidence suggests hidden malware, but the capability set is unsafe and disproportionate for general agent deployment.

This code is not a passive library; it is an autonomous offensive security “hunting” agent. It dynamically executes local package modules (hunt.py via exec_module; brain.py via sys.path injection), and it drives exploitation-grade scanners (sqlmap/fuzzing/RCE/CMS checks) based on LLM tool_calls. While explicit malware like exfiltration/cryptomining/backdoors is not evidenced in this fragment, the supply-chain/local code execution and high-impact offensive automation make the overall security risk substantial.

This skill is a high-risk offensive capability pack for password spraying and credential attacks. Its behavior is internally consistent with its stated purpose, but that purpose is to help an AI agent perform real intrusion attempts against third-party accounts, so it should be classified as suspicious/high risk rather than benign.

This code is an offensive, weaponized web vulnerability scanner. It actively attempts exploitation techniques (time-based SQLi verification, upload-to-RCE PoC by uploading server-side executable code, SSTI math canaries, SAML signature stripping test, MFA workflow/rate-limit probes) and writes “confirmed” exploitation artifacts. There is no clear stealth, obfuscation, or external exfiltration in the snippet, but the intended behavior is high-impact and easily misused. Treat as high security risk in a supply-chain setting; it should not be used as an untrusted dependency and should be gated/audited for authorization and operational controls.

The fragment exhibits multiple high-risk, adversary-friendly trading mechanics: (1) router swaps accept unbounded slippage (`amountOutMin=0`), (2) swaps can be forced through an owner-configured routing pool (`mandatoryPool`), and (3) rebasing can be triggered during DEX interactions (`_rebase()` in `_transfer` when touching `uniswapPair`). Together these create predictable conditions for MEV/sandwich exploitation and unfair price impact. There is no clear evidence of classic off-chain/on-system malware (exfiltration, backdoors, persistence), but the economic extraction and user-trading safety risk are substantial given the shown logic.

SUSPICIOUS: the skill is internally consistent as a mobile pentest guide, but its actual footprint is a high-risk offensive security capability set for AI agents. Tool provenance is mostly legitimate, yet the combination of decompilation, credential extraction, SSL pinning bypass, signer recovery, and live API attack workflows makes it dangerous even without clear malicious deception.

The provided file is best characterized as an offensive WebSocket testing/exploitation harness with explicit CSWSH-style credential abuse and direct exfiltration of WebSocket-received data to an attacker-controlled domain. The code contains multiple hardcoded attack probes (authz/authn bypass testing, IDOR via victim identifiers, XSS/SQLi-like payloads, and admin action attempts). There is no evidence of obfuscation; the suspiciousness is in the explicit malicious behavior and payloads. If this behavior appears in a dependency that can be executed automatically during install or runtime, it should be treated as a critical supply-chain red flag and removed/reviewed urgently.

The code is an active, token-driven security testing/exploitation script for HackerOne that probes for IDOR and related access control flaws. It performs authenticated cross-account reads, prints sensitive account data upon suspected findings, and includes GraphQL mutations that could change report state and send invitations—capabilities that are clearly offensive in nature. There is no conventional malware behavior (no obfuscation, no persistence, no local system compromise), but the tool’s design meaningfully supports unauthorized access if misused. Overall, this should be treated as high-risk tooling rather than benign library code.

This module is best characterized as a malicious payload generator: it implements deliberate Unicode steganography (U+2062/U+2064) to embed hidden prompt-injection instructions inside otherwise visible text, and it also packages extensive offensive security exploitation/probing payloads. While it does not execute commands or perform network exfiltration directly, it produces and exports weaponized artifacts (including cleartext references) intended for downstream abuse against LLMs/assistants or security targets. Treat as unsafe/malicious in a software supply chain context; it should not be included in trusted dependencies.

SUSPICIOUS: the skill is coherent with its stated purpose, but that purpose is to give an AI agent offensive smart-contract auditing and exploit-PoC capability. Dependency provenance is mostly consistent and data flows are direct to the configured RPC provider, yet the combination of exploit tooling plus credentialed RPC use makes it high security risk even without clear malware behavior.

No clear signs of classic malware (no exec/eval, subprocesses, persistence, or secret exfiltration) are present in this module. However, it is a dual-use security-testing utility that can actively probe targets with SQLi/traversal-like payloads during calibration and it disables TLS certificate verification/hostname checks for outbound requests, which is a significant safety and integrity risk (MITM can alter results). If this dependency is used in an automated supply-chain context, it should be sandboxed/permissioned and the insecure TLS + active probing behavior should be explicitly controlled or removed.

SUSPICIOUS/HIGH-RISK but not malware. The skill is internally consistent as a bug bounty methodology, yet it grants and coordinates offensive security capabilities, authenticated testing, and OOB workflows that are dangerous for an AI agent to execute. Main concern is high operational risk and scope, not deceptive data exfiltration by the skill itself.

No direct evidence of embedded malware (e.g., backdoor/exfiltration/credential theft) is visible in this Python fragment. However, the module has substantial security and supply-chain risk: it repeatedly executes shell commands with shell=True while interpolating user-controlled target/domain values into command strings (command-injection potential), downloads third-party wordlists without integrity pinning, and alters sys.path at runtime (import-hijack risk). Because the script delegates the real recon/vuln/fuzz actions to external scripts/tools, the overall package risk is high if the inputs, invoked scripts, or environment can be influenced by an attacker.

SUSPICIOUS. The skill is coherent with its stated CI/CD security purpose, but that purpose is itself an offensive security capability for an AI agent. Its footprint is high risk because it teaches exploitation and exfiltration paths, invokes external scanners via an unseen installer script, and combines untrusted target content with shell-based analysis. Not confirmed malware, but unsafe to grant broadly.

SUSPICIOUS: the skill is internally coherent as a GraphQL pentest guide, but it is a high-risk offensive-security skill for an AI agent. It enables live exploitation, brute force, and DoS-style testing against external targets; supply-chain risk is moderate, while operational misuse risk is high.

SUSPICIOUS: the skill is internally coherent as a web recon playbook, but it gives an AI agent high-risk offensive security capabilities, broad outbound scanning behavior, and multiple credentialed integrations. There is no strong evidence of malware or deceptive exfiltration, yet the operational risk is high because the skill meaningfully increases the agent’s ability to probe external targets autonomously.

This fragment is an offensive WAF/authorization bypass probe tool. It actively sends crafted requests (including TRACE and spoofed forwarding headers) and even includes an encoded script payload for baseline sampling, then records which responses look like bypasses. While it does not show classic malware behaviors (no reverse shell, no credential theft, no file system persistence, no network exfiltration to third-party domains), it is high-risk from an abuse perspective because it enables exploitation/bypass testing. Additionally, it sources and executes external package components (external_arsenal.sh, banner.sh, waf_response_analyzer.py, and optionally byp4xx/wafw00f), which could contain additional malicious behavior not visible here—so the supply-chain risk depends heavily on those files’ integrity.

The analyzed fragments collectively present a high-risk security profile dominated by upgradeability governance weaknesses, insufficient signature-domain protections, potential ERC4626 mispricing, and role-management uncertainties. Even without explicit exploit code, the combination of unguarded upgrade paths, reinitialization risks, and asset-control surfaces warrants treating the package as unsuitable for production use until a thorough, context-specific audit is completed and remediation is applied (tighten upgrades, implement proper nonce/domain handling, secure ERC4626 pricing, complete initializer safeguards, and fix role grants). Security risk is high due to the potential for unauthorized upgrades, replay and DoS vulnerabilities, and financial manipulation; operational risk is significant until fixes are applied.

This module is best classified as an offensive security testing tool for Zendesk with high misuse potential: it performs authorization-bypass-style IDOR enumeration, unauthenticated exposure probing, GraphQL introspection with optional local persistence, and—most importantly—creates tenant webhooks pointing to internal/metadata/localhost-style endpoints (an SSRF-style capability). No clear stealth/persistence or classic malware behavior is present in the visible fragment, but it can materially interact with and modify a tenant, making it a security-risk artifact if run without explicit authorization and tight scope controls.

SUSPICIOUS/HIGH-RISK skill due to giving an AI agent concrete blockchain security exploitation and audit capabilities against financial systems. It shows no clear credential theft, malware payload, or exfiltration path, but it materially increases offensive capability and references an unverifiable local scanner component.

This module is an active, authentication-dependent security testing/exploitation script. It takes real session cookies from the operator, fetches CSRF tokens, then performs multiple authenticated GraphQL mutations that can change report state/content and take actions such as disclosure requests, bounty awards, assignment, and email sharing if authorization checks fail—consistent with IDOR detection. The most notable implementation risk is disabling TLS certificate verification while transmitting sensitive cookies/CSRF tokens, which can expose the operator to MITM. There is no clear evidence of classic malware (backdoor/exfiltration), but the operational security risk is high because it is inherently attack-oriented and performs state-changing actions against a third-party service.

No clear evidence of stealthy malware, but the provided module implements multiple high-risk web behaviors: an SSRF/proxy-like /fetch endpoint that fetches arbitrary user-supplied URLs and returns their responses, an open redirect via /go, reflected injection risk via unescaped /search input, and environment/debug information disclosure via /api/debug (plus a suspicious /.env route). If this dependency/module were exposed beyond a tightly controlled local demo context, it would present a significant security risk.

No explicit backdoor, keylogging, exfiltration, cryptomining, or dynamic code execution for malicious purposes is present in this script. However, the script performs high-impact supply-chain operations: it executes a remote installer script via curl|bash, downloads and installs a binary tarball without checksum/signature verification, and installs/updates multiple components from unpinned remote sources (go @latest and git clone/pull). These patterns make the installer a meaningful supply-chain risk if the upstream sources (or network path) are compromised, even if the intent appears to be legitimate bug-bounty tooling.

The provided code fragment is an attacker-style GraphQL recon and active probing harness. It explicitly attempts bypasses (GET-based introspection when blocked), performs disruptive workload tests (batching/alias/depth bombs), runs injection-oriented scanning (gqlmap/SQLi-style probe), and persists detailed reconnaissance results to disk. While it is not obviously implementing persistence/stealth malware inside the fragment, its operational intent and side effects make it highly risky to distribute or execute against any systems without explicit authorization.

This shell script is not a benign dependency; it functions as an offensive OSINT-to-credential-candidate pipeline. It harvests employee emails from public sources, derives/enriches names, generates username permutations, and (optionally) creates personal-style password candidates, then instructs how to use those artifacts for credential spraying. While the fragment shows no direct exfiltration or stealth, its end-to-end behavior materially enables unauthorized access attempts. Primary risks are (1) high misuse potential due to credential-spraying preparation and (2) execution of locally stored tools without integrity verification, increasing supply-chain/trust risk if those binaries are tampered.

Overall, the provided code appears to be an installer/CLI setup script rather than a self-contained malware payload. However, it contains two notable high-risk supply-chain/remote-execution patterns: (1) executing a remote shell script from `https://ollama.ai/install.sh | sh` when Ollama is not installed, and (2) installing Python packages (`pip3 install ...`) without version pinning. The privileged symlink into `/usr/local/bin` (when possible) is also an operational risk, though it targets a repo-local `engine.py`. No clear malicious exfiltration or backdoor logic is visible in this excerpt.

This fragment is best characterized as a pentest-style offensive security testing CLI targeting authentication/OAuth behavior on a specific hardcoded domain. It performs outbound requests with attacker-controlled headers and (optionally) a user-supplied Bearer token, parses OAuth redirect parameters from server responses, and prints exploit-enabling test URLs and vulnerability indicators. There is no evidence of stealth, persistence, or direct data theft/exfiltration in the shown code; however, the exploit-oriented purpose and the inclusion of token/session probing makes it security-relevant. Confidence is reduced because the snippet appears syntactically incomplete (invalid print statement and truncated main invocation).

This module is purpose-built offensive automation for HTTP credential spraying and valid-credential discovery. It iterates provided username/password lists, optionally extracts CSRF tokens, submits form POSTs to a configured target, infers likely success via response regexes/redirect heuristics, and logs results (including user identifiers and password-hash prefixes). It also disables TLS certificate validation and hostname checks, increasing the risk and ease of interception in hostile environments. Use is highly unsafe unless you can strictly verify authorized testing in a controlled setting.

This code is not evidence of traditional malware or supply-chain sabotage (no obfuscation, persistence, or hidden payloads). However, it is an abuse-oriented authenticated security testing harness that automates concurrent 2FA OTP attempts and state-changing GraphQL/REST mutations (bounty acceptance, negative bounty validation, and email-change racing). If bundled into a dependency and executed with real tokens, it can enable unauthorized probing/exploitation patterns and should be treated as high-risk from a misuse standpoint. Review should focus on distribution/authorization controls and whether tokens/targets could be supplied or used unexpectedly.

This module is a dual-use multipart mutation/probing tool: it intentionally generates malformed multipart/form-data payloads (boundary and Content-Disposition edge cases, including traversal-like subparameter injection) from a user-supplied file, writes the variants to disk, and can optionally POST each variant to an arbitrary operator-supplied URL. There is no direct evidence of stealthy malware (no credential theft, persistence, command execution), but the active request-sending capability and exploit-oriented payload crafting raise the practical security risk if misused or bundled into production tooling.

This module is highly suspicious and likely malicious in intent: it is explicitly a “hidden/invisible prompt injection” payload generator/encoder that conceals attacker instructions using Unicode stealth and can output/save ready-to-deploy injection artifacts. While it does not perform network exfiltration itself, it includes exfiltration-oriented instructions/URLs and prompt-injection objectives (system prompt/tool extraction, cross-tenant probing, RAG poisoning, and response overriding). Treat it as high-risk supply-chain tooling; avoid using it in dependencies for production or untrusted environments.

This Bash module is a high-risk supply-chain component because it orchestrates password-spraying/credential-stuffing style login attempts against a specified target, dispatching to network-capable handler scripts and an external O365/Okta spraying binary. While it includes interactive confirmations, rate/timing controls, and a dry-run option, these are operator safeguards and do not mitigate the underlying offensive capability. No overt obfuscation or direct malicious payload behavior (beyond attack orchestration) is visible in this fragment, but the intent and actions are strongly consistent with credential-attack tooling, with additional risk of sensitive material exposure via environment variables and audit logging of tool output.

High misuse potential. The fragment is an operator-focused playbook that chains OSINT/breach-based candidate generation with staged decision logic culminating in HTTP-form credential spraying against a specified login endpoint, including persistent logging and resumable workflow design. Even though it instructs the agent not to execute and mentions dry-run/user consent gates, it remains directly actionable for authentication-attempt execution, which is strongly associated with malicious credential attacks.

This module is highly indicative of malicious/abusive functionality: it performs OAuth2 password-grant credential spraying by iterating attacker-supplied user/password lists against a target token endpoint, identifying likely success via access_token presence, and persisting detailed attempt telemetry (including password hash prefixes and success indicators). It further increases operational risk by disabling TLS certificate verification and hostname checks, making it easier to intercept or tamper with authentication traffic. It should not be included as a dependency in benign software supply chains.

This module is high-risk client-side reconnaissance code. It installs hooks on fetch and XHR to capture and retain GraphQL/AI/Hai/Copilot-related request bodies (via JSON parsing) and parsed response JSON, then can export the full captured dataset (including responses) to the clipboard through haiDump(). Additional helper functions fetch and scan all loaded JS bundles for keywords and reveal hidden UI elements, further supporting surveillance and mapping of application behavior. Overall, the behavior strongly matches unauthorized data collection/exfiltration patterns rather than benign debugging.

This module is an offensive testing orchestrator that uses real bearer tokens to interact with HackerOne’s GraphQL API and then launches companion scanners/tetst tools. It contains a concrete high-risk coding anti-pattern (`eval $CMD`) where user-provided variables are interpolated into a shell command string without robust escaping, creating a command-injection risk on the machine running it. While this file itself shows no obvious self-contained malware/persistence/exfiltration to unrelated domains, the launcher’s nature plus delegation to other scripts and token handling makes it security-relevant and potentially harmful if tampered with or misused.

This module is an offensive, automation-focused WAF/authorization bypass tool. Its documented behavior—adaptive WAF/vendor fingerprinting, bypass-request mutation (headers/path/method/content-type), block-baseline calibration and scoring, and extraction/logging of WAF incident identifiers—materially enables unauthorized probing and likely follow-on exploitation. The inclusion of payload encoding/mutation and multipart parser-confusion bypass tooling further increases abuse potential. As a supply-chain dependency, it would represent a high security risk due to its evasion/exploitation orientation and conditional delegation to an external bypass package. No clear obfuscation is evident from the provided fragment, but the threat is intent and capability rather than concealment.

The fragment is highly abuse-enabling malicious guidance for constructing multi-stage exploit chains. While it is not executable code, it provides concrete steps and decision logic to achieve severe outcomes such as OAuth authorization-code theft leading to account takeover, SSRF-based cloud/IAM credential harvesting, XSS→CSRF admin privilege escalation, secret extraction from exposed web assets, and prompt-injection-driven data exfiltration. Treat any inclusion in a software supply chain as a high security risk artifact.

This module is high-risk due to its explicit role in preparing credential-attack inputs: it gathers public employee identifiers (via search engines and CT/log sources), derives names and likely usernames, and optionally generates likely personal password mutations, writing attack-ready lists to disk. While it does not demonstrate authentication/exploitation in the provided fragment, the described outputs and ‘password spray prep’ framing make it strongly indicative of abusive capability if distributed or used outside authorized testing.

The provided fragment describes a credential-attack wordlist generator that crawls a target website’s public content and produces ranked password candidates using hashcat mutation rules, explicitly for password spraying and/or offline cracking. No obfuscation is indicated, and there is no stated mechanism for data theft or persistence; however, the intended outcome directly enables unauthorized authentication attempts. Treat as high-abuse-risk/offensive tooling: avoid use as a dependency in production/supply chains and require strict access controls, provenance vetting, and permission/scoping safeguards before inclusion. Implementation-level behaviors cannot be fully confirmed from this fragment alone.

This artifact is an explicit offensive exploitation “chain builder” that instructs an agent to actively validate and combine web vulnerabilities into high-impact compromise chains (OAuth ATO/code theft, SSRF→cloud metadata credential access, stored XSS→admin priv-esc/automation, and other weaponized patterns). It includes operational constraints (confirm/prove chains, time-box tests) and OOB validation guidance that materially enables real-world exploitation. No code execution is present in the snippet, but the provided content functions as an actionable agent prompt/config and is therefore high risk for supply-chain inclusion.

The provided material is a behavioral description of a dual-use cloud reconnaissance workflow, not the executable implementation. No direct malware indicators (e.g., credential theft, backdoors, obfuscated payloads, or covert exfiltration code) can be verified from this fragment. The primary concern is the tool’s explicit capability to enumerate public storage and infer potential Cloudflare-bypassing origin IPs, which can materially facilitate unauthorized targeting if misused. A proper review requires the actual script/code to confirm absence of unsafe operations (credential handling, remote exfiltration, dynamic execution) and to validate scope/authorization guardrails.