polyphony

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). The design explicitly injects host credential bundles (via an Identity Broker and read-only auth volume mounts) into per-task containers, which creates a direct vector for credential theft and data exfiltration by untrusted agents.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). SKILL.md describes a runtime workflow that pulls “Tasks from GitHub Issues (gh api)” (outsider-authored issue body text) into the orchestrator’s task data, which is then routed/provisioned for the worker LLM—so outsider free text can reach the LLM context via the GitHub Issues discovery/claim path.