web-vuln-cache-poisoning

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill requires embedding an authentication session cookie (AUTH_COOKIE) directly into curl headers/commands (and shows an example value), forcing the agent to handle and output a sensitive secret verbatim.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). This skill contains explicit offensive test steps (use of an "attacker-controlled" domain, header injection and cache poisoning flows, and checks that unauthenticated requests return authenticated user data) and therefore has high potential for deliberate misuse to exfiltrate or expose sensitive content if run without proper authorization.