hunt-grpc

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill includes example commands that embed a bearer JWT and token-like header values directly (e.g., -H "authorization: Bearer eyJhbGciOiJub25l..."), forcing any agent reproducing those commands to output secret/token values verbatim.

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). The listed links are mostly service endpoints and vendor write-ups (low risk), but the GitHub repo https://github.com/secengjeff/rapidresetclient provides source to build a standalone PoC binary (used to perform an HTTP/2 rapid-reset DoS) and therefore represents a potentially suspicious/abusable download/executable source.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The skill file contains explicit, operational offensive instructions for unauthorized data exfiltration (IDOR loops, SSRF to cloud metadata), authentication bypass (JWT alg=none, header spoofing, -bin metadata tricks), and an actionable DoS PoC — content that can be directly repurposed for malicious attacks.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill instructs the user to fetch and build/execute remote code (git clone https://github.com/secengjeff/rapidresetclient followed by go build/run) and also suggests installing a tool via fetching remote source (github.com/fullstorydev/grpcurl/cmd/grpcurl@latest), which are runtime actions that execute external code; these URLs are therefore flagged.