hunt-lfi

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.95). The skill explicitly instructs reading sensitive files (e.g., .env, ~/.aws/credentials) and tells the user/agent to "report exactly what you recovered" and "show real contents," which requires the LLM to include secrets verbatim in its outputs.

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 1.00). These URLs include attacker-controlled "OOB"/shell hosts and an unlabeled external host (http://x) used for remote file inclusion callbacks — classic high-risk RFI/malware distribution vectors, not trusted download sources.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This document is an offensive exploitation playbook that intentionally instructs how to exfiltrate sensitive files, steal credentials, and achieve remote code execution/backdoors via LFI/RFI, log poisoning, php:// filter chains, uploads, and OOB callbacks.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The required runtime workflow ingests outsider-authored free text via user-supplied URL/body parameters (e.g., ?file=/?page= path traversal/LFI targets) and then drives the LLM to generate OOB confirmation payloads that depend on the application’s included file contents.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly instructs the operator to "git clone https://github.com/synacktiv/php_filter_chain_generator" and run its Python script (SKILL.md:105-106), which fetches and executes remote code used to generate payload chains — a runtime external dependency that executes remote code.