re-tool-frida

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill captures network payloads and explicitly asks for raw 32-byte excerpts and writing capture data into the output report, which requires the agent to emit verbatim byte sequences that may contain secrets or credentials.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). High-risk dual-use capability: the skill describes deliberate DLL injection/PE import patching to load a remote-listening frida gadget and hooks send/recv to capture network payloads to disk, enabling remote code execution and data exfiltration.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill instructs fetching and deploying the frida-gadget DLL from https://github.com/frida/frida/releases (frida-gadget--windows-x86_64.dll.xz), which is downloaded and injected into the target process at runtime (remote code executed and required), so it is a runtime external dependency that executes remote code.