open-redirect

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 1.00). These URLs include attacker-controlled domains (evil.com, attacker.com, phishing sites), open-redirect parameters on otherwise-trusted hosts, and internal-metadata endpoints (169.254.169.254) — patterns commonly used for phishing, token theft, SSRF and to deliver or bootstrap malware distribution.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This document is an explicit attack playbook describing open-redirect exploitation, token/credential theft (OAuth token and auth code exfiltration), SSRF chaining, phishing amplification, and bypass/obfuscation techniques — clearly intended for malicious use.