subdomain-takeover

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). These are not direct download links but point to a generic subdomain (sub.target.com) described in a subdomain-takeover playbook — if that subdomain is unprovisioned or points to a decommissioned third‑party service an attacker could claim it and host malware under a trusted target.com domain, so it's potentially suspicious.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This document is an explicit offensive playbook that instructs how to detect, claim, and exploit subdomain/NS/MX takeovers to intercept data, issue certs, and hijack email—clear malicious intent and high abuse potential.