deep-invade

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill's procedures explicitly search for, extract, and print secrets (DB credentials, API keys, bearer tokens, and other token patterns) and also inject a user-supplied collaborator URL into requests, which requires the agent to handle and potentially output secret values verbatim.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This skill explicitly instructs offensive actions — SSRF to cloud instance metadata, automated credential and secret extraction, staging takeover checks, exploitation scanning (sqlmap/nuclei), and anonymized scanning via Tor — indicating clear intent to discover and exfiltrate sensitive data and achieve remote compromise.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). SKILL.md’s workflow ingests outsider-authored free text at runtime by fetching and grepping attacker-controlled WordPress error logs (e.g., https://$TARGET/error_log and https://$TARGET/wp-content/debug.log) and also downloading JavaScript bundles from the target to extract secrets.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill explicitly instructs running "sudo systemctl start tor" (and notes that nmap may require root), which asks for sudo privileges and directs starting/modifying a system service — actions that change the host's state and require elevated rights.