hunt-mfa-bypass

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill contains numerous examples and commands that require inserting session cookies, device_code/device tokens, JWTs, OTPs or other secrets verbatim into curl/Python/Turbo Intruder requests, so an agent following it would need to handle/output secret values directly.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This document contains explicit, actionable offensive instructions (brute-force OTPs, race-condition exploitation, device-code phishing, token/cookie capture and reuse, distributed IP evasion, and backup-code exfiltration) intended to enable account takeover and credential theft.