recon-laundromats

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This skill explicitly instructs how to discover and retrieve customer PII, exposed invoices, and API keys from target sites and how to enumerate/probe endpoints for exploitation, enabling data exfiltration and credential theft.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). This skill’s required workflow uses runtime curl to fetch outsider-authored public web content from https://$TARGET/... (e.g., wp-content/debug.log, uploaded form storage, and directory listings), and those fetched HTML/text bodies are then parsed and could be included in the agent’s LLM context as readable output.