password-spray-methodology

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill repeatedly embeds literal credentials and password examples in commands, scripts, and logging (e.g., curl -u "user:pass", KNOWN_GOOD="user:CorrectP@ss", logging password chars), which requires the LLM to handle and output secret values verbatim and is therefore insecure.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This document is an explicit operational guide for credential theft and account takeover via password spraying, including user enumeration, evasion (IP rotation, throttle bypass), multi-protocol credential stuffing, lateral movement, and post-compromise data collection — indicating deliberate malicious intent and high-risk abuse potential.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The runtime workflow described in Password Spray Methodology ingests outsider-authored free text by scraping user-generated content sources (e.g., LinkedIn/company pages) to build username/password lists before spraying, enabling indirect prompt injection via submitted posts/comments names.