unauth-api-flow-hijack

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly instructs extracting session IDs/tokens from responses and embedding those identifiers verbatim into subsequent curl/python requests (e.g., using flow_id, $FLOW_ID, or "OLD_SESSION_ID"), which requires the LLM to handle and output secret/session values directly.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This document is explicit offensive guidance for exploiting unauthenticated multi-step API workflows — enabling unauthorized data access, file upload abuse, session enumeration/replay, and extraction of storage URLs for exfiltration.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The skill’s runtime workflow ingests only attacker-controlled network responses from an unauthenticated target API’s multi-step endpoints (e.g., /api/flow/start, /api/flow/submit, /api/flow/upload, /api/flow/export) and uses the returned JSON/error messages as LLM-visible free text.