kernelgen-flagos

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The skill mandates sending local repository code, environment details, and user-provided JWTs to an external "kernelgen-mcp" service and then automatically writes, registers, runs, and (optionally) commits the returned code—this creates clear data-exfiltration, remote code execution, and supply-chain/backdoor injection risks if the MCP or configuration is untrusted.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The workflow ingests outsider-authored free text via the MCP service responses (e.g., mcp__kernelgen-mcp__generate_kernel / optimize_kernel return test_func_code and benchmark_func_code as readable text that is then read/placed/executed), and that returned text is not authored by the operating user.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill mandatorily requires contacting the kernelgen MCP service at runtime (configured via the URL users are directed to obtain at https://kernelgen.flagos.io/), and the MCP tools (mcp__kernelgen-mcp__generate_kernel / mcp__kernelgen-mcp__optimize_kernel) return code and instructions that directly control generation/execution — therefore the external kernelgen MCP endpoint is a required runtime dependency.