hunt-oauth

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly shows and instructs embedding captured secrets/tokens/credentials (e.g., CAPTURED_CODE, access_token, client_secret, password) into curl/PoC commands, which would require the LLM to handle or emit secret values verbatim.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This document is an explicit offensive playbook that instructs how to steal OAuth tokens, perform account takeover, and exfiltrate credentials — it is intentionally malicious in purpose and content.