rterm-backend

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The required runtime workflow ingests outsider-authored free text when the agent receives userInput over the WebSocket JSON-RPC gateway (e.g., agent:startTask), so anyone who can send RPC messages into the gateway can supply prompt text to the LLM.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill explicitly instructs installing/enabling system services (placing units under /etc/systemd/system and running systemctl), suggests global npm installs, and exposes tools/SOPs (systemctl, usermod, reset-password, scheduled deletion commands) that modify system files or user accounts and therefore require elevated privileges.