scada-hikvision-isapi

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This skill is an explicit reconnaissance and exploitation playbook for Hikvision devices (endpoint discovery, credential guessing, unauthenticated data access, SSRF) and therefore represents clear malicious/offensive intent and high abuse potential.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The skill’s runtime workflow downloads and parses JavaScript bundles from a user-supplied TARGET and extracts /ISAPI/... paths from the fetched response bodies (outsider-authored free text via the target’s JS), so poison content can be ingested without first selecting a specific item.