pylot-api

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). The docs expose admin secret-discovery and keychain-loading APIs plus a skill-loading + self-wake flow that can inject resolved secrets into a workspace and execute code — enabling credential theft and remote-code/exfiltration abuse if misused.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The required workflow includes “Workers read the issue thread during orientation” (dispatch prompt best-practice), which means outsider-authored GitHub issue/comment body text can be fetched and ingested as readable prompt context for the worker/LLM.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The docs show runtime POSTs to "$PYLOT_GATEWAY_URL/conversations/$CONV_ID/resources" (e.g., to "load a skill" so it "syncs into workspace" on the next turn), which is a high-confidence runtime fetch that injects remote skill content that can change agent behavior/instructions.