hunt-csrf

CRITICAL E004: Prompt injection detected in skill instructions.

• Potential prompt injection detected (critical risk: 1.00). Provides explicit, actionable exploit instructions (PoC HTML, curl commands, and bypass techniques) for performing CSRF attacks that can enable account takeover and other harmful state-changing actions.

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill includes examples and commands that capture, reuse, and embed session cookies and CSRF/OAuth tokens (e.g., Cookie: session=..., authenticity_token=$TOKEN_A, oauth_token_here), which instructs copying secret values verbatim into PoC requests/commands and therefore requires the LLM to handle/output secret values directly.