recon-sector-expansion

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). High risk: the skill provides step-by-step, automated mass reconnaissance and vulnerability discovery (crt.sh scraping, WP REST user enumeration, port scanning) and explicitly uses a malicious Origin (https://evil.com) to detect credentialed CORS — techniques commonly used to enable unauthorized compromise and credential harvesting.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The runtime workflow ingests outsider-authored free text from crt.sh’s HTML responses at https://crt.sh/?q=${sector}&excluded=expired&dedup=Y (queried using sector keywords), and it also reads full HTML/HTTP bodies from any outsider-chosen candidate domains during the alive-check and subsequent testing steps (e.g., curl ... "https://{domain}{path}" and curl ... "https://{domain}").