error-log-mining

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly extracts API keys and database credentials (via regex/grep and Python extraction) and writes them verbatim to console and a summary file, requiring the agent to handle and output plaintext secrets.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This skill and script are explicitly designed for offensive reconnaissance: locating exposed PHP error logs, extracting database credentials, API keys, tokens, server paths and other sensitive data for later use — i.e., deliberate data exfiltration and credential theft for exploitation.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The runtime workflow downloads and parses outsider-controlled content from a user-supplied target URL (e.g., curl ... "$TARGET/error_log" and mine_error_log.py <https://target.com/error_log>), then the LLM/code ingests that fetched free-text error log for extraction.