hunt-race-condition

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The skill includes examples that embed session cookies directly into curl/Python request headers (e.g., "Cookie: session=YOUR_SESSION" / {"Cookie":"session=XXXXX"}), which encourages placing real authentication cookies/tokens verbatim into commands or scripts and therefore creates an exfiltration risk.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The document contains explicit, actionable offensive techniques and ready-to-run exploit templates (HTTP/2 single-packet delivery, PIN/OTP brute-force, rate-limit bypass, multi-request race templates) that enable credential theft, financial fraud, and account takeover.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly targets financial actions and provides concrete tooling and payloads to manipulate them. It names monetary/credit systems and payment flows as high-value targets, cites Stripe coupon/wallet examples, and includes Turbo Intruder templates that construct and race wallet/transfer/deposit/withdraw endpoints (e.g., POST /api/transfer with amount fields, multi-endpoint "withdraw + deposit" race). Those are specific, finance-oriented APIs/requests (not generic browser or HTTP tooling) intended to perform or abuse fund/credit transfers and coupon redemptions, which constitutes direct financial execution capability.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill explicitly instructs running "sudo tcpdump" (packet capture) on the host, which directs the agent/user to obtain elevated sudo privileges on the machine.