5dive-cli-extras

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The runtime workflow exposes outsider-authored free text via channel ingestion: 5dive agent telegram-discover/team-bot use long-poll getUpdates and message content is forwarded into agent tasks (delegation example shows arbitrary user message text wrapped in a <channel ... message_id ... user ...> envelope).

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill exposes a CLI command that explicitly updates spending limits: "sudo 5dive usage budget set worker-1 --daily=2000000 [--ceiling=] [--hard-stop]". Updating budgets is an explicit API to change spend/budget configuration (a financial-execution-like capability per the policy), so it meets the "manage budgets" criterion.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill doc repeatedly instructs use of sudo for actions that create agents/accounts, import packs, write secrets, modify fleet/org state, and run root-only setup helpers — all of which request or require elevated privileges and can change the host system state.