sector-recon-methodology

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). Most URLs are safe/placeholder or point to crt.sh (a legitimate CT service), but https://evil.com is an explicit attacker-controlled/suspicious domain used in the script as an Origin/Referer (could be used to host or test delivery of malicious payloads).

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This repository contains an offensive reconnaissance workflow that automates mass targeting, harvests WordPress user lists and exposed secrets (.env/.git), tests CORS for credential reflection (using an "evil" origin), and even documents an explicit attack chain to exfiltrate data and takeover sites — making it high-risk for misuse outside authorized engagements.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In scripts/parallel_sector_probe.py, the script reads outsider-controlled free text from HTTP responses on attacker-provided domains (e.g., JSON from /wp-json/wp/v2/users and raw page/body text from endpoints like / .git/config and /.env) during runtime probing.