web-vuln-saml-sso

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This content is an offensive SAML testing toolkit that includes deliberate methods to bypass signature validation (signature stripping, XSW), impersonate users (NameID manipulation/comment injection), replay assertions, and perform XXE-based file reads — enabling authentication bypass and data exfiltration if used without authorization.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The required workflow ingests outsider-authored free text via SAML_RESPONSE_B64, decoding it into XML at runtime (base64 -d + xmllint + grep), and then uses that content to craft and POST modified SAML responses to the target ACS URL.