cors-chain-automation

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). These URLs include attacker-controlled, typosquatting, and out-of-band/exfil endpoints used in CORS PoCs (e.g., evil.com, eviltarget.com, target.com.evil.com, OOB-ID.oastify.com), so they are suspicious and could host or distribute malicious payloads.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The document contains explicit offensive instructions and ready-to-run PoCs to read authenticated user data via CORS (using victims' cookies), an explicit instruction to "host on evil.com", and an (optional) out-of-band exfiltration call — indicating deliberate malicious/abusive intent to steal data.