web-vuln-race-conditions

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly asks for an AUTH_TOKEN value and shows placing it verbatim into curl commands/headers (e.g., -H "Authorization: Bearer $AUTH_TOKEN"), which requires the LLM/user to handle and embed secrets directly, creating an exfiltration risk.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). This is a dual-use offensive testing guide: framed for legitimate testing but contains explicit instructions and evasion techniques (high-concurrency bursts, IP rotation, targeting OTP/financial flows) that could be used to commit fraud or bypass protections.