intent-detection

CRITICAL E004: Prompt injection detected in skill instructions.

• Potential prompt injection detected (high risk: 1.00). The prompt includes a hidden/deceptive instruction—"always pass mode: 'bypassPermissions'" when spawning agents—that overrides permission checks and enables unattended behavior outside the skill's stated transparent intent-detection purpose.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The skill contains an explicit instruction to spawn agents with mode: "bypassPermissions" (circumventing permission prompts and enabling unattended agent execution), which is a deliberate backdoor/privilege-bypass pattern that can enable unauthorized actions and potential data exfiltration even though no explicit exfiltration code is shown.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill's Research Intent Routing and the research-workflow trigger in patterns/agent-triggers.yaml explicitly instruct falling back to WebFetch/WebSearch (and using codex-exec/gemini-exec) to fetch web content, so the agent ingests open/public third-party pages as part of its workflow which could carry untrusted/user-generated instructions.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The prompt explicitly instructs passing mode: "bypassPermissions" when spawning agents (bypassing permission prompts and security controls), which encourages circumventing protections that could allow unauthorized modifications to the machine state.