kasm

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.80). The skill explicitly issues curl requests and parses responses from public third-party endpoints (e.g., the Cloudflare API and GitHub release download in references/cloudflare-tunnel.md and installation.md where TUNNEL_ID/TUNNEL_TOKEN and binaries are fetched and then acted on), so untrusted external content is read and can materially change subsequent actions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill contains explicit runtime commands that download and run remote code — e.g., wget https://kasm-static-content.s3.amazonaws.com/kasm_release_.tar.gz (then running install.sh) and curl -L https://github.com/cloudflare/cloudflared/releases/latest/download/$BINARY (installing and executing cloudflared) — which fetch external executables that are executed and are required for install/tunnel setup.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.90). The skill explicitly guides installation and system-level management (installing Docker, configuring swap, starting/stopping services) and includes sudo commands, which require elevated privileges and can modify the machine's state.