hunt-csrf

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill repeatedly shows and instructs embedding session cookies, CSRF/authenticity tokens, and OAuth tokens directly into curl commands and PoC HTML (e.g., Cookie: session=..., authenticity_token usage), which requires the LLM/user to handle and output secret values verbatim.

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 1.00). The list contains an attacker-controlled git repository URL (https://attacker/manifest.git) which is a direct repository source that could host malicious manifests or payloads for automated deployment tools (high risk).

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This document contains highly actionable, offensive CSRF exploit techniques and ready-made PoCs (auto-submitting forms, Content-Type bypasses, token-reuse curl scripts, WebSocket/SignalR abuse, subdomain takeover session fixation) that enable account takeover, credential/session theft, and unauthorized state changes — high risk for malicious misuse.