journey-report

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). The code intentionally pipes arbitrary user questions to a local "claude" CLI while granting it named tools (including Bash/Read/Grep/Glob) and returns the agent's output—this design enables remote code execution and easy data access/exfiltration by the agent process if that CLI or model backend is compromised or allowed to call out.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The only outsider-authored free text is the user’s chat question sent to this skill’s required runtime /api/ask endpoint (scripts/serve.py → scripts/ask.py passes question.strip() verbatim to the claude CLI), which the agent then uses to read/query the local lake to answer.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.90). The skill explicitly tells the operator to start the server with JOURNEY_ASK_PERMISSION_MODE=bypassPermissions to bypass the machine's permission settings, which encourages circumventing security controls.