rterm-systems-thinking

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In scripts/systems-thinking.mjs, the outsider-provided CLI arguments (e.g., frame <problem>, decompose <system>, tradeoff <design>, prioritize <reqs...>, build <playbook>, operate [host]) are assembled into userInput and sent verbatim to agent:startTask, so the required runtime workflow ingests outsider-authored free text without pre-selecting any trusted item.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.90). The skill explicitly instructs the agent to "build" and "deploy" on real hosts (across SSH/WinRM/Serial fleets) and gives concrete examples—rendering/applying nginx configs, running playbooks, creating scheduled tasks and fleet commands—which require modifying system files and privileged operations on the machine(s) the agent controls.