wooyun-legacy

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). Yes — several URLs point to attacker-controlled hosts or known exploit artifacts (obfuscated SSRF, remote WAR/DTD endpoints and cloud metadata) that are commonly used to deliver malware or perform data-exfiltration via SSRF/XXE/RCE vectors.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). The content is a dual‑use vulnerability knowledge base but contains many explicit, operational exploit recipes (XXE OOB/exfil, SQLi/UNION patterns, Redis CONFIG writes to create webshells/authorized_keys, reverse‑shell cron entries, eval/exec/OGNL payloads, external script XSS payloads) that enable unauthorized data exfiltration, remote code execution and persistence.

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I scanned the documentation for literal, high-entropy credential values that look like real, usable secrets. I flagged only values that are not obvious placeholders or low-security defaults.

Flagged:

• references/unauthorized-access.md: the lstate value 515csmxSi1aTO9ysxvJ1Gpmnj7hHuPxjMdfZdEP49lJZ is a long, random-looking token (likely a fixed auth parameter/key) and appears to be a real credential.
• references/unauthorized-access.md: the telecom home gateway default telecomadmin/nE7jA%5m includes mixed-case and special characters (percent-encoding present) and appears to be an explicit default admin credential.

Ignored (not flagged) — examples of expected false positives per the guidance:

• Common default/weak passwords like admin/admin, admin/123456, weblogic/weblogic, root/root, etc. — low entropy and documented as defaults.
• Placeholders and redactions such as "YOUR_API_KEY", "xxx", or example redacted URLs — not real secrets.
• Short numeric verification codes (123456, 0000) and sample unzip/setup passwords mentioned as examples — considered low-security examples or documentation artifacts.

I did not find any PEM/private-key blocks or live API keys (sk-..., etc.) beyond the two high-entropy literals above.