cloud-ctf

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). The required workflow mainly runs cloud CLI calls against the user's own or challenge-provided accounts, but it also fetches arbitrary challenge-supplied URLs (leaked URL, storage URL, SAS URL) and clones a community tool repository, so an outsider can publish content the agent must actively fetch.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (medium risk: 0.30). The skill clones and executes enumerate-iam.py from an individual developer's GitHub repository, which is an operational setup dependency with unofficial, reputable-but-not-first-party provenance, so it is medium; other URLs (IMDS, WorkDocs thumbnails, SAS URLs, reference docs) are data or static documentation and do not qualify.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.70). The skill is a CTF playbook, but it instructs the agent to create a new user account with SSH access and sudo rights via GCP metadata injection, and to overwrite the kernel's core_pattern setting, both of which change machine state and require privileges.