claude-code-skill

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The required runtime path claude-code-skill session-send forwards user-supplied message text through apiCall('/session/send', ...) into the backend session, where the agent loop consumes it (and can further use tools), so outsider-authored free text is ingested before any trusted-item selection.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.80). The skill explicitly exposes tools that run arbitrary shell commands and write/edit files (e.g., Bash, Write, Edit), uses auto-accept edit modes and a "bypassPermissions" mode, and shows adding system dirs (/var/log) — enabling an agent to modify system state or run privileged operations unless carefully restricted.