pentest-playbook

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.95). The playbook explicitly directs discovery and extraction of .env, JS bundle secrets, Firebase/Supabase API keys and service account keys and requires findings to be "reproducible with the exact command," which implies the agent will need to capture and output secret values verbatim (API keys, tokens, private keys) — a high-risk secret-exfiltration pattern.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). Contains explicit, actionable offensive instructions for credential theft, data exfiltration (CORS/Firebase/Supabase/Cloud IAM), exploitation (RCE/SSRF/SQLi), and OPSEC evasions which enable deliberate abuse or unauthorized access.