hunt-sharepoint

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). This skill explicitly instructs capturing and reusing sensitive tokens and credentials (e.g., FormDigest values, session cookies, and plaintext username/password in the SOAP Login) and shows curl/command examples that embed those values verbatim (X-RequestDigest header, SOAP , FedAuth cookie), which requires an agent to handle/output secret values directly.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This document contains explicit, repeatable offensive instructions (anonymous SOAP credential brute-force, ToolShell precondition chain leading to unauthenticated RCE/webshell, credential theft, request smuggling, and lateral-movement steps) that enable deliberate malicious activity.