nacos-skill-registry

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The skill’s runtime workflow uses nacos-cli skill-list/skill-get/skill-describe to fetch skill metadata and skill files from the user-configured Nacos registry (public/third-party content), which can include outsider-authored free text (e.g., SKILL.md body) that the agent then reads into its LLM context.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's installation commands instruct fetching and executing remote installer scripts at runtime (curl -fsSL https://nacos.io/nacos-installer.sh | sudo bash ... and iwr ... https://nacos.io/nacos-installer.ps1 ...), which downloads and runs remote code required to obtain the nacos-cli.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (medium risk: 0.60). The prompt explicitly instructs running a remote installer with sudo (curl ... | sudo bash ...) which requests elevated privileges and modifies system state, so it encourages actions that can compromise the host even though most other actions are user-level config and harmless.