hunt-llm-ai

CRITICAL E004: Prompt injection detected in skill instructions.

• Potential prompt injection detected (critical risk: 1.00). The document explicitly describes and provides templates for malicious techniques (prompt/system-prompt extraction, data exfiltration via markdown/SSRF/tool-use, ASCII smuggling, RCE and IDOR) that enable secret exfiltration and unauthorized access.

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill includes explicit exfiltration templates and examples that instruct embedding sensitive fields (e.g., {user.ssn}, {session.token}, admin tokens, IMDS data) into generated outputs/URLs, which requires the LLM to include secret values verbatim for exfiltration.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The skill’s required runtime workflow is a generic “hunt AI feature bugs” framework that targets prompt injection via LLM-ingesting outsider-authored content (e.g., uploaded docs/web pages, chat inputs) and also assumes tool-use like fetch_url where attacker-supplied text/URLs can be processed at runtime.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.85). The skill explicitly describes and encourages RCE/sandbox-escape techniques (e.g., Python os.system), SSRF to fetch IMDS, and privilege abuse with admin tokens—actions that can lead to compromising or modifying the host/worker machine state.