hunt-deserialization

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 1.00). These URLs include direct downloads of exploit tooling (ysoserial .jar), and GitHub exploit repositories plus attacker-controlled COLLAB_HOST endpoints used to host or trigger payloads — all strong indicators of malicious/malware-distribution intent.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This document is an explicit offensive exploitation guide that instructs how to craft and deliver deserialization payloads (ysoserial, phpggc, pickle, ViewState, JNDI/Log4Shell) to achieve RCE, set up OOB callbacks, and exfiltrate data—clearly malicious intent to compromise systems.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill downloads and executes remote tooling at runtime (wget https://github.com/frohoff/ysoserial/releases/latest/download/ysoserial-all.jar then java -jar, git clone https://github.com/ambionics/phpggc used via php phpggc, and git clone https://github.com/pimps/JNDI-Exploit-Kit), so these URLs fetch code that is executed and are required for the exploit workflows.