recon-smb-services

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly searches for and prints secrets (JWTs, DB credentials, API_KEY/SECRET, cookies) from logs and includes examples that embed cookie/header values, which requires capturing and outputting secret values verbatim.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This repository is an explicit offensive recon and exploitation playbook targeting small-business websites, containing instructions and PoCs for data exfiltration, credential harvesting, SSRF/CORS abuse, and remote exploitation chains.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The required workflow in SKILL.md uses runtime curl to fetch arbitrary target web pages and directories (e.g., /wp-content/debug.log, /wp-content/uploads/..., and gallery image URLs), and those fetched responses are then parsed/grepped as readable text—so outsider-authored free text from the target sites can enter the agent/LLM context indirectly via the tool outputs.