powerloop

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The runtime workflow ingests first-party queue/free-text from the user-written .powerloop/YYYY-MM-DD-<name>.note.md and related progress/log tables that are later re-read each cron cycle to provide “context from the previous cycle,” so outsider-authored content can reach the LLM via the progress file notes/log entries.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.80). The skill instructs the agent to create persistent scheduled jobs (CronCreate/CronDelete), immediately execute the first cycle, and create a .powerloop directory—actions that modify the host's state and can introduce persistent execution even though it doesn't request sudo explicitly.