broken-authentication

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). This skill explicitly instructs capturing and embedding plaintext credentials, session cookies, and tokens into requests/commands (e.g., POST bodies, Authorization headers, Cookie values, Hydra/Burp payloads), which requires the model to handle or output secret values verbatim.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This document contains explicit, actionable instructions for credential theft and account takeover (brute-force, credential stuffing, OTP brute-force, JWT/token manipulation), plus evasion techniques (IP rotation, header spoofing, host-header injection) that enable malicious abuse if used without authorization.