shannon

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill instructs creating configs and export commands that embed credentials (YAML with username/password, example export ANTHROPIC_API_KEY=sk-ant-...) and would prompt the agent to ask for and paste secrets verbatim into files/commands — a direct secret-exfiltration risk.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This skill intentionally orchestrates and runs real, mutative pentest exploits (via Dockerized tooling, browser automation, Nmap, etc.), and while presented as white‑hat it is a high-risk dual‑use capability that can be abused to perform unauthorized attacks or data exfiltration if used without strict authorization and controls.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). At runtime the skill launches Shannon against a user-supplied TARGET_URL and Shannon’s browser automation/recon will ingest arbitrary page content from that outsider-controlled web target into LLM context (indirect prompt injection risk via fetched web text).

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill's installer and runtime use git clone to fetch and then execute the Shannon code from https://github.com/KeygraphHQ/shannon.git (see git clone ... and later ./shannon start), so remote code is fetched at runtime and executed providing required functionality.