hunt-ssti

CRITICAL E004: Prompt injection detected in skill instructions.

• Potential prompt injection detected (critical risk: 1.00). The document provides explicit, actionable exploit payloads and techniques to achieve remote code execution and secret exfiltration via server-side template injection.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (critical risk: 1.00). The skill explicitly directs escalation to remote code execution and includes actionable, runnable exploit payloads that execute arbitrary commands on target servers (e.g., Jinja2 os.popen, Twig registerUndefinedFilterCallback("exec"), ERB backticks), demonstrating intent and a viable execution mechanism.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). SKILL.md describes crafting SSTI payloads to test provider features like “email templates,” “PDF/report generators,” and “error pages with user input,” meaning the runtime workflow would need to render outsider-supplied free text into templates for evaluation.