amazon-rufus-ai

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). The raw GitHub URL is used to download and immediately execute a shell setup script from a third‑party repository (FinpeakInc), which is a high‑risk pattern for delivering malware if the repo/maintainer is not trusted; the Amazon and localhost URLs are not download sources.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). This skill deliberately downloads and execs a remote setup script and then runs a local tool that sends full Amazon URLs (and relies on the user's Chrome session), creating clear supply‑chain and remote code‑execution vectors that could be abused to exfiltrate credentials or data.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). Outsider-authored free text is ingested into the LLM context via the user-supplied --url and --question, which are concatenated into PROMPT="${URL} ${QUESTION}" and sent to frevana_ask as the prompt field (the URL content is fetched by Rufus/Chrome session at runtime, and the question is free-form text from outside the operating user’s chosen prompt).

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The bundled setup wrapper (scripts/setup.sh) downloads and execs remote code at https://raw.githubusercontent.com/FinpeakInc/frevana-cli-releases/refs/heads/main/skills/frevana/scripts/setup.sh during runtime, so external content is fetched and executed.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.80). The skill explicitly instructs the agent to download and execute an external setup script (scripts/setup.sh which itself fetches and runs a remote installer), which can modify the host (install a daemon, change services, require elevated privileges) and thus pushes the agent toward changing machine state.