okta-attack

CRITICAL E004: Prompt injection detected in skill instructions.

• Potential prompt injection detected (critical risk: 1.00). This skill is a detailed offensive playbook giving step-by-step techniques to discover Okta tenants, enumerate users, bypass or abuse MFA (push fatigue, SMS, FastPass), perform password-spray and phishing/AiTM attacks, tamper OIDC/SAML redirects, and conduct post-compromise admin API actions.

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill includes explicit curl examples that place passwords, state/session tokens, and SSWS API tokens directly into command bodies or Authorization headers, which requires the LLM to handle and potentially emit secret values verbatim.