cors-cross-origin-misconfiguration

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 1.00). Multiple entries are explicit attacker-controlled domains (attacker.com, evil.com and variants), obfuscated/typosquat forms (target.com.attacker.com, encoded/backtick forms), and exfil endpoints (/.../collect, /exfil, /log) which are strong indicators of malicious hosts used for data exfiltration or hosting malware.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The documents contain explicit offensive CORS/JSONP exploitation techniques and code snippets that perform credentialed requests and direct data exfiltration to attacker-controlled endpoints, representing high-risk malicious behavior.