crypto-web-attack

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt explicitly shows commands and scripts that take encrypted tokens/cookies (ENCRYPTED_TOKEN, COOKIE_VALUE, BASE64_ENCRYPTED_COOKIE) and embed or print them verbatim (e.g., padbuster CLI calls and Python scripts that decode/forge/print tokens), meaning an agent would need to handle secret/session token values directly in output.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This content is an explicit offensive playbook that provides step‑by‑step, executable techniques (PadBuster and Python scripts) to decrypt/forge cookies, flip CBC bits, predict weak tokens, and perform hash length extension to escalate privileges or tamper with authentication — clearly facilitating unauthorized access and abuse.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 1.00). The SKILL.md explicitly instructs the agent to fetch and interpret responses from arbitrary target URLs (e.g., PadBuster commands like "padbuster http://target/ ..." and Python oracle code that calls requests.get(f"{URL}?token=...") and inspects status_code/text), which clearly ingests untrusted third‑party web content and uses those responses to drive subsequent actions.