sdlc-agentic-pipeline

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The code-reviewer (and DevOps) agents can ingest outsider-authored free text by reading GitHub PR diffs and changed files via GitHub MCP (e.g., github_pull_request_read with get_diff) as part of the required runtime PR review workflow.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). I flagged the onboarding/install commands that fetch and execute remote code at runtime: the npx command using https://github.com/CodeArtsAgent/CodeArtsSkills (references/setup/service-onboarding.md:23) and the Go install of github.com/hashicorp/terraform-mcp-server/cmd/terraform-mcp-server@latest (references/agents/devops-agent.md:594), both of which pull and run remote code as part of the skill's runtime onboarding/setup steps.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (medium risk: 0.60). The skill explicitly references "auto-provision agents" and deployment to Huawei Cloud ECS and includes template scripts (add_ssh_key.py, apply-tool-selections.sh) that can modify system/user state (SSH keys, tool installation, provisioning), which indicates potential for the agent to change machine state even if sudo is not explicitly requested.