graphql-and-hidden-parameters

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This skill explicitly guides discovery and exploitation of hidden GraphQL fields, batching/IDOR attacks, and JWT/auth abuse to access privileged data and perform unauthorized exfiltration or privilege escalation.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.65). This skill describes GraphQL introspection/probing and error-based discovery, which at runtime would ingest server-provided schema/type/field text and error messages into the agent’s LLM context (outsider-authored free text from the target system responding over HTTP/graphql APIs).