information-disclosure-methodology

Fail

Audited by Socket on Apr 22, 2026

3 alerts found:

Securityx2Malware
SecurityMEDIUM
references/api-param-tricks.md

This fragment is an exploitation guide for Web/API parameter manipulation aimed at authorization bypass and mass information disclosure. While it does not provide evidence of malware execution/backdoors within the dependency, its presence would constitute high security risk content because it operationalizes concrete techniques for triggering unauthorized queries and extracting large datasets.

Confidence: 80%Severity: 85%
SecurityMEDIUM
SKILL.md

该技能是面向 AI 代理的攻击性信息泄露利用手册,核心能力包括扫描外部目标、恢复源码、提取并使用凭据、以及进一步访问 SSH/Web/数据库。其能力与“exploit”分类一致,但整体用途高度危险,不适合作为普通通用技能;更应视为高风险 offensive security skill,而非 benign developer guidance。

Confidence: 94%Severity: 93%
MalwareHIGH
references/source-recovery.md

The provided “source code” is an explicit offensive exploitation playbook, not a benign dependency module. It instructs how to extract source code and credentials from exposed .git/.svn/.DS_Store and related backup/log and API documentation endpoints, including repository reconstruction and historical secret harvesting, with guidance to use recovered credentials for further unauthorized access. No legitimate software functionality or protective security logic is present in this fragment.

Confidence: 82%Severity: 92%
Audit Metadata
Analyzed At
Apr 22, 2026, 10:11 AM
Package URL
pkg:socket/skills-sh/wgpsec%2FAboutSecurity%2Finformation-disclosure-methodology%2F@d78987a72ae6ddbcfe0cca06ffc4f82f21292fd7