agent-doorbell

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The runtime path hook-runner.js reads free-form JSON from STDIN (fs.readFileSync(0, "utf8")), and that payload ultimately contains fields like last_assistant_message/prompt_response/message/summary, so an outsider-authored message could be ingested whenever the agent runtime emits it into the hook.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (medium risk: 0.50). The skill instructs the agent to install/edit runtime hook settings and run bundled installer scripts that modify user-local configuration (changing machine state) and includes a PowerShell "-ExecutionPolicy Bypass" flag (a security-policy bypass), though it does not request sudo or create users.