post-exploit-technique

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). The required workflow runs local host commands and reads target-owned files, logs, and tool output, which the org-files rule excludes, but it also has the agent fetch and execute public community artifacts such as the linpeas script from a GitHub release and named third-party exploit PoCs, which is a selected-item fetch (low).

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (medium risk: 0.30). The skill's setup pipes a curl download of linpeas.sh from a GitHub releases/latest URL directly into sh on the target, so executed code comes from a remote source; the PEASS-ng project is maintained by an individual, so it is common/reputable unofficial rather than strong first-party provenance, and latest without a digest adds no authentication, giving medium.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.88). The skill directs the agent to perform post-compromise actions that change host state: creating systemd service units, injecting SSH keys into root's authorized_keys, planting SUID backdoors and cron jobs, and escalating privileges, which matches the flagged categories of service-file and SSH-config modification and privilege escalation.