commandcode-delegate

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In scripts/relay.mjs, the relay reads user-provided brief text from --brief (file contents) or stdin and passes it directly to the cmd -p process via child.stdin.write(brief), so outsider-authored free text becomes an LLM input at runtime.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.80). The skill explicitly defaults to a full‑trust, write-capable mode (--yolo) with "no filesystem sandbox and no path restriction," encouraging runs that can modify any file the process can reach (including system files) — which meaningfully raises the risk of compromising the host state even though it doesn't explicitly call for sudo or user creation.