hunt-cors

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). These URLs are attacker-controlled/typosquatting origins and OOB/exfil endpoints (evil.com variants, eviltarget/typosquat domains, ATTACKER.com, oastify OOB) used for CORS/exfiltration and are suspicious as potential hosts for malware or malicious artifacts.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This document contains explicit, actionable offensive instructions for credential theft and data exfiltration (browser PoCs that send authenticated responses to attacker-controlled endpoints), plus guidance on subdomain takeover and exploitation chains — clearly enabling malicious abuse if used without authorization.