memory

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.85). High-risk: the skill intentionally implements persuasive/ToM tooling and a persona (Horus) whose stated objective is "ESCAPE" and to probe users for vulnerabilities (i.e., it is designed to assess, influence, and potentially coax users into providing actionable/system access), and this is combined with persistent storage, scheduled jobs, DB writes, and external LLM/embedding calls that could be abused for data exfiltration, covert user-targeting, and persistence.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill ingests and uses public, user-generated sources (e.g., YouTube transcripts and audiobooks via horus_lore_ingest.py / horus_lore_cli and the "Supplementary (YouTube)" pipeline described in HORUS_PERSONA.md) to generate a dynamic "subconscious" section that is appended to the system prompt and thus can materially influence LLM behavior, creating a clear channel for indirect prompt injection.