flask-werkzeug-attack

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly instructs extracting the debugger SECRET from error HTML and then embedding that SECRET verbatim into curl requests (e.g., s=SECRET), so the LLM would need to handle/output secret values directly.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This document is an explicit offensive guide showing how to discover and exploit Flask/Werkzeug debugger instances to leak SECRETs, exfiltrate source/config data, and perform remote code execution.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). The skill’s runtime workflow only involves sending HTTP requests to a target to trigger Werkzeug/Flask error pages and extract stack traces/HTML containing SECRET and console flags, but it does not ingest any outsider-authored free text from a user-controlled queue/feed/input the workflow monitors without selecting a specific item.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill contains curl commands that POST/GET to "https://target.com:PORT/sitemap.xml?__debugger__=yes&cmd=..." (e.g., https://target.com:PORT/sitemap.xml?__debugger__=yes&cmd=eval&code=__import__('os').system('id')&s=SECRET) which are used at runtime to execute arbitrary Python code on the remote server, meeting the criteria for remote code execution via an external URL.