recon-plumbing

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This document is a targeted reconnaissance playbook explicitly designed to find and harvest sensitive PII, payment data, and media (debug logs, contact CSVs, uploaded videos) from plumbing company sites and includes techniques that facilitate unauthorized data exfiltration and exploitation.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). SKILL.md’s required workflow uses runtime curl to fetch outsider-authored free text from public web content (e.g., https://$TARGET/wp-content/debug.log, https://$TARGET$path form pages, and directory listings under /wp-content/uploads/), which is then parsed/grepped and thus becomes LLM-readable context.