hunt-nodejs

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This file is an offensive exploitation guide with concrete payloads and network callbacks to achieve remote code execution, credential/environment exfiltration, and bypasses—indicating deliberate malicious intent and operational abuse.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The runtime workflow described in SKILL.md is an outsider-driven vulnerability hunt that directly ingests free-form attacker payloads via HTTP request bodies/parameters (e.g., curl -X POST ... /api/merge, /api/render, /api/template with template/__proto__/payload strings), so the agent would be exposed to indirect prompt injection-style text from the attacker-controlled request content.