bug-bounty-methodology

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The content explicitly instructs how to steal credentials and sensitive data (cookies, tokens, IAM keys), escalate privileges (mass assignment, ATO), and achieve remote code execution or persistent backdoors (SQLi -> INTO OUTFILE webshell, SSRF to metadata for keys), i.e., deliberate guidance for data exfiltration, privilege escalation, RCE and installing backdoors that can be misused outside authorized testing.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). This skill's SKILL.md workflow (Step 2 Recon and Step 3 Map and analyze) explicitly fetches and ingests content from arbitrary public targets (using tools like subfinder, httpx, gau, katana, and curl to download pages and JS files) and then parses that untrusted third‑party content to drive discovery and testing decisions.