orchestrator-cli

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The required runtime workflow ingests outsider-authored free text by reading GitHub Issues/comments in GitHub mode during the “Discover” step (and then posting/using those records as context for workers).

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.90). The skill explicitly instructs use of flags and configuration that bypass provider permissions and sandboxes (e.g., --dangerously-skip-permissions, --dangerously-bypass-approvals-and-sandbox, sandbox_mode="danger-full-access"), which pushes the agent to bypass security controls and thus compromises the runtime/machine state.