gitops-workflow

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The SKILL.md explicitly instructs fetching and executing public, user-controlled content (e.g., kubectl apply -f https://raw.githubusercontent.com/argoproj/argo-cd/stable/manifests/install.yaml, curl -s https://fluxcd.io/install.sh | sudo bash, and ArgoCD/Flux Application/GitRepository entries pointing to GitHub repos), meaning the agent would ingest and act on untrusted third-party repository/manifests that could contain instructions influencing deployments.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill includes runtime commands that fetch and execute remote content required for operation—e.g., "kubectl apply -f https://raw.githubusercontent.com/argoproj/argo-cd/stable/manifests/install.yaml" and "curl -s https://fluxcd.io/install.sh | sudo bash"—so external URLs are used at runtime to execute remote code/manifests.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). Flagged because the skill explicitly includes a "curl ... | sudo bash" install command that asks the agent to obtain sudo privileges and modify system-level files on the host.