hunt-websocket

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). Skill document contains explicit, actionable exploit instructions (CSWSH PoC with out‑of‑band exfil, privileged WS frames, message tampering, and handshake smuggling) that enable direct data theft and remote abuse if used maliciously.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The skill’s runtime workflow ingests attacker-authored free text indirectly via externally observable WebSocket messages/frames (e.g., CSWSH PoC receives e.data from a victim over wss://$TARGET/ws and records/logs/exfiltrates it), so outsider-supplied content can be consumed by the agent before any selection/filtering.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly instructs how to tamper with WebSocket messages for trading/checkout flows (modify price, amount, orderTotal) and shows an explicit replay example that sends a "buy" action via wscat to a trade endpoint. Those are concrete instructions to create/modify market/order transactions (financial execution), not merely generic tooling or browsing automation.