hunt-misc

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). This skill repeatedly instructs testers to capture session cookies/PATs and shows curl commands that embed those tokens (Authorization/COOKIE/PRIVATE-TOKEN headers), which requires the LLM to handle and output secret values verbatim.

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). These URLs are not direct download links for executables, but they include attacker-controlled domains and a CRLF/redirect vector (header-injection / SSRF/exfiltration) that are high-risk abuse paths which could be used to deliver or trigger malicious payloads.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This document contains explicit, actionable exploitation techniques (SSRF to attacker-controlled endpoints, CRLF/cache-poisoning to set attacker cookies, invitation/SAML/OAuth-based account-takeover methods and instructions to capture/exchange auth tokens) that can be directly abused for credential theft, data exfiltration, and account takeover.