Broken Authentication Testing

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). This skill repeatedly instructs constructing requests, commands, and code that include plaintext credentials, session cookies, tokens, and reset tokens (e.g., username/password in POST bodies, Cookie: SESSIONID=..., Authorization: Bearer ...), which requires the agent to handle or emit secret values verbatim.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The content includes explicit, actionable techniques for credential theft, brute-force/credential-stuffing, session/token manipulation, and evasion (IP rotation, forged headers, host header injection) that could be directly abused to gain unauthorized access.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 1.00). The skill explicitly instructs fetching and analyzing content from arbitrary target application URLs (e.g., GET/POST to https://target.com/login, capturing session cookies and password reset/reset links) and to use public breached credential datasets (e.g., "Have I Been Pwned"), so it ingests untrusted third-party web content as part of its workflow.