governed-autonomy-loop

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The required runtime workflow spawns the governor LLM with a prompt that includes untrusted queue/unit body text (outsider-authored free text) via the tracker adapter’s read-unit/list-queue data, which the governor then uses as input to the LLM context (prompt-injection boundary, invariant 3).

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill explicitly instructs authors to fill and enable launchd/systemd unit templates ("templates/launchd.plist.template" / "templates/systemd/*.template" and "enable it"), which directs modification of system service files and changing system/runtime state (actions that typically require elevated privileges).