xmlrpc-exploitation

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill's procedures explicitly embed plaintext credentials (e.g., "password123"), build XML payloads by inserting passwords from a wordlist, and instruct retrieving/using out-of-band tokens (IMDS creds, Mailinator rp_key), which requires handling and including secret values verbatim in requests or generated payloads.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This document is an explicit offensive exploitation guide that instructs SSRF to internal metadata, amplified credential brute-forcing, and uploading/executing a PHP webshell for RCE — clear malicious intent and abuse functionality.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The skill’s runtime workflow reads outsider-provided free text from targets.txt (domains/targets list) via while read -r domain; do ... curl ... https://$domain/xmlrpc.php ... done < targets.txt, which an outsider can supply to drive the requests and affect any LLM/parsing behavior tied to the results.