ffuf-web-fuzzing

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly instructs creating raw request files and examples that include Authorization headers, cookies, and JWTs and tells the agent to insert users' auth tokens/cookies into req.txt for authenticated fuzzing, which requires outputting secret values verbatim.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill instructs the agent to run ffuf against arbitrary external targets (e.g., many examples like "ffuf -w ... -u https://target.com/FUZZ", batch processing with targets.txt, and authenticated raw requests captured from Burp/DevTools) and the agent/ffuf_helper.py is expected to read and analyze the resulting ffuf JSON/output (results.json), which is untrusted public/user-generated web content—so the agent will ingest and interpret third‑party responses.