web-vuln-mfa-bypass

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). This skill embeds sensitive values (session cookie and OTP/backup codes) directly into curl commands and variables (e.g., SESSION_COOKIE, KNOWN_OTP), which requires the LLM to output those secrets verbatim when producing runnable commands — a direct secret-exfiltration risk.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This skill contains explicit, actionable techniques to bypass MFA (brute-force OTPs/backup codes, OTP reuse, race conditions, response manipulation, direct post-MFA navigation, and automated MFA-disable probes) which can be directly abused to gain unauthorized account access.