sbom-syft

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.65). The required runtime workflow is generating SBOMs by running syft against container images/archives/dirs (e.g., syft <image> / syft oci-archive:nginx.tar / syft dir:/path), which causes Syft to ingest and parse package metadata from those targets—potentially including outsider-authored content from public registries or downloaded archives—into the agent’s LLM context via the tool’s readable output (e.g., syft-text/JSON rendered as prose).

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill includes runtime install commands that fetch and execute remote code—specifically curl -s https://raw.githubusercontent.com/aquasecurity/tfsec/master/scripts/install_linux.sh | bash (tfsec install in the CI job) and wget https://github.com/sigstore/cosign/releases/latest/download/cosign-linux-amd64 (cosign download in the signing workflow)—which download and run external binaries/scripts required by those workflows.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.80). The prompt includes commands to download, chmod, and move a binary into /usr/local/bin (system-wide installation), which modifies system files and typically requires elevated/sudo privileges, so it pushes the agent toward changing the machine state.