web-cache-deception

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The skill includes an explicit curl example embedding a session cookie header (curl -H "Cookie: session=VICTIM"), which is the insecure pattern of placing secret/session tokens directly into command output and would encourage verbatim handling of credentials.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This repository contains an explicit offensive playbook that instructs how to perform web cache deception and cache poisoning attacks to exfiltrate authenticated data and serve attacker-controlled content (XSS, redirects, resource injection) to other users.