s3-minio-content-type-xss

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). These URLs include cloud-storage object links with the query parameter "response-content-type=text/html" (cdn.target.com/uploads/...), a known technique to override Content-Type on S3/MinIO and serve attacker-controlled HTML/JS same-origin — a high-risk vector for delivering malicious scripts/XSS and hosting payloads.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This document is an explicit, step-by-step exploit guide for abusing S3/MinIO response-header overrides to achieve same-origin stored XSS (including creating polyglot payloads, generating signed S3 URLs, and accessing cookies/localStorage), showing clear malicious intent and high risk of data theft and session compromise.