aicoo

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). The pack includes explicit, high-risk capabilities (automatic session uploads, verbatim transcript export, and a long-lived bridge that registers an endpoint and allows remote agent requests using the user's API key) which are legitimate features but also map directly to data-exfiltration and remote-access/backdoor patterns that can be abused.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). On-demand inbox/guest-transcript monitoring ingests outsider-authored message content by calling GET https://www.aicoo.io/api/v1/conversations?... and GET https://www.aicoo.io/api/v1/os/network/conversations/...{sessionId} (and then processes message content for summaries/actions) as part of the “Inbox Monitoring” and “Guest Conversation Transcripts” workflows.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill pack instructs the runtime/user to fetch and run remote code (git clone + npm install / npm run) from https://github.com/Aicoo-Team/aicoo-local-agent.git and https://github.com/Aicoo-Team/AICOO-Skills.git (and also uses npx to execute @aicoo/raw-memory), which is clear high-confidence evidence of runtime-executed external code.