ascii-art

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). Outsider free text can be fetched at runtime from public web sources (e.g., Tool 7 “ascii.co.uk” pages via curl, and Tool 8 services like wttr.in/qrenco.de), whose returned HTML/plain text is then parsed/ingested into the agent’s context.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (medium risk: 0.60). The skill repeatedly instructs installing system packages using sudo/snap (and pip with --break-system-packages), which directs the agent to perform privileged system changes — albeit for benign tools and without explicit instructions to modify config files or create users.