web2-recon

CRITICAL E004: Prompt injection detected in skill instructions.

• Potential prompt injection detected (medium risk: 0.30). The document provides detailed, actionable reconnaissance and secret-discovery procedures (subdomain enumeration, scanning, JS secret extraction, GitHub dorking, takeover checks, etc.) that clearly enable weakening security boundaries and could facilitate unauthorized access, but is presented as defensive/bug-hunting material rather than explicitly malicious instructions.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). SKILL.md’s required runtime workflow ingests outsider-authored free text by crawling attacker-controlled/untrusted web targets and executing JS/HTML extraction pipelines (e.g., crt.sh and waybackurls JSON/body/title parsing, plus katana/SecretFinder/LinkFinder fetching and scanning arbitrary JS files from discovered live/crawled URLs).