hunt-rce

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 1.00). Several attacker-hosted endpoints in the list point to direct executable/artifact delivery (JAR and shell scripts) and an XXE DTD callback URL — classic malware distribution / remote-code-execution vectors.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The document contains explicit, actionable exploit instructions (remote JAR loading, SSRF→IMDS credential theft, cron/backdoor installation, dependency-confusion with postinstall callbacks, COPY FROM PROGRAM exec, webshell upload paths, OOB exfiltration payloads, prototype-pollution→env tampering) that enable unauthorized data exfiltration, backdoors, and remote code execution.