hunt-fastapi

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This document contains step‑by‑step offensive techniques to discover and exploit FastAPI auth/validation weaknesses (endpoint enumeration, auth bypass, privilege escalation, and destructive operations), enabling unauthorized access and abuse.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). SKILL.md describes a runtime that actively downloads and parses a target’s outsider-authored OpenAPI schema from /openapi.json (and /docs /redoc) to mine endpoints, so the LLM workflow ingests attacker-influenceable free text from that externally provided schema.