automations

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). The automation system exposes agent-created, persistent automations that can run as a user (runAs=creator), execute arbitrary agentic loops, and perform outbound HTTP with server-side secret substitution — capabilities that can be deliberately abused for data exfiltration or to install covert backdoors.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.65). SKILL.md:23-24 describes that in agentic mode the dispatcher runs runAgentLoop with the automation body as the prompt and the event payload as context; since event payloads come from integrations/webhooks (outsider-authored text), this can feed free-form outsider content into the LLM context.