controller

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill prompt embeds plaintext credentials (Dashboard "admin / hermes") and instructs inclusion of reproducible PoCs (curl commands) and example SSH key usage, which forces the LLM to output or reproduce secret values verbatim if used, creating an exfiltration risk.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The content describes an intentionally offensive automation platform: built-in redteam tooling, automated/anonymous scanning and exploitation workflows, auto-approved dangerous commands (YOLO/cron), automatic delivery of results to Telegram, and persistent storage/search of all conversations—features that enable stealthy scanning, automated exploitation, and potential data exfiltration.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). SKILL.md describes an architecture where Telegram chat commands/results drive the agent (“Telegram → controller … Handles Telegram chat”), and those Telegram inputs can be outsider-authored free text that the agent later uses as LLM context, creating an indirect prompt-injection path.