rterm-gateway

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill contains examples and RPC/CLI patterns that instruct embedding tokens, API keys, and passwords directly into headers/JSON/command lines (e.g., websocat -H Authorization, observability:secretsSet value, TerminalConfig password), which would require an LLM to reproduce secret values verbatim in generated commands/requests.

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). One of the URLs is a direct raw.githubusercontent.com link to a Windows .exe hosted in a personal GitHub repo (DrOlu/agent-tools), which is a high-risk distribution vector for malware.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). SKILL.md describes the required runtime path as a WebSocket JSON-RPC gateway where an outsider can send arbitrary userInput/RPC params (e.g., agent:startTask*, terminal:write, filesystem:*) and that free text is ingested by the agent/tools without first selecting a specific item.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill exposes explicit APIs to view and modify spending budgets and caps. The observability RPC list includes costSetBudget / costRemoveBudget / costListBudgets and examples show settings:set can set cost.budgets with capUsd values. These are concrete methods to change monetary budget/policy (adjust USD caps/throttle/deny), which meets the criterion for direct financial execution authority.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill explicitly exposes RPCs and agent tools that run arbitrary commands, write/delete files, create/modify cron jobs, install plugins, manage IAM/users, and restart/update services (e.g., apt/yum, systemctl), enabling headless changes to the host state and requiring/implicitly using elevated privileges.