parallel-recon-triad

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt explicitly instructs agents to find credentials (API keys, JWTs, AWS/GCP/Firebase keys), "authenticate and test further", and to analyze JS bundles for keys—forcing the agent to handle and potentially embed secret values verbatim in requests/commands, which is high-risk secret exfiltration.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The content is clearly malicious: it documents an automated, persistent orchestration framework for parallel reconnaissance and exploitation, including OPSEC methods (Tor/proxy), exploitation chains (CORS, XMLRPC, RCE/SSRF), credential/cloud-key harvesting, and instructions to hide/remove traces — high risk of deliberate abuse.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The required workflow uses cronjob/delegate_task to spawn subagents that read prior recon outputs from /root/output/... (e.g., deep/ and targets/), which are populated from runtime target probing and thus can include outsider-authored free text (web responses, scraped content, and target-provided pages) that the LLM ingests via the context/read-files path.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.90). This skill instructs the agent to install packages (apk add), start background services (tor), create and remove cron jobs, write/delete files under /root, and perform kernel-level proxy setup — all actions that modify system state and typically require elevated (sudo/root) privileges.