hunt-django

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The skill includes examples that require inserting and echoing real session cookies and SECRET_KEY values into commands/code (e.g., echoing a session cookie to decode it and using a leaked SECRET_KEY in a signer), which instructs treating secrets as literal values and would cause the LLM or user to output secret values verbatim.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This document provides explicit, actionable exploitation techniques (SQL injection to exfiltrate credentials, destructive queries, admin brute-force, session cookie decoding and forged signed cookies) that enable unauthorized data theft, account takeover, and destructive actions.