hash-attack-techniques

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill's examples and CLI/code snippets require embedding MAC/signature hex strings directly (e.g., hashpump -s "known_mac_hex", --signature "known_mac_hex", and parsing original_mac in Python), which forces the agent to handle and potentially emit secret MAC values verbatim, creating an exfiltration risk.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This document contains explicit, actionable instructions and code for forging and tampering with cryptographic hashes (length-extension, collision generation), automating HMAC-timing attacks, and tools for creating rogue files/certificates — functionality that can be directly abused for credential/signature forgery and stealthy binary/certificate substitution.