cdata-cli

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The CData CLI runtime workflow ingests outsider-authored free text from the user via command arguments such as drivers download --url <jar-url>, query sql --sql "SQL", and drivers connectionprops/connection create/update connection-string values, which the CLI passes to downstream systems and/or outputs.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill includes runtime install commands that fetch-and-execute remote scripts from https://downloads.cdata.com/cdatabuilds/builds/free/cdatacli/install-cdatacli-windows.ps1, https://downloads.cdata.com/cdatabuilds/builds/free/cdatacli/install-cdatacli-macos.sh, and https://downloads.cdata.com/cdatabuilds/builds/free/cdatacli/install-cdatacli-linux.sh (e.g., curl | bash / irm | iex), which downloads and runs remote code required to install the CLI.