thunderdome

CRITICAL E004: Prompt injection detected in skill instructions.

• Potential prompt injection detected (medium risk: 0.30). The repository contains multiple instructions and code that weaken sandboxing and escalate privilege for host execution — e.g., advising mounting host storage and GPU passthrough, unsetting environment isolation, invoking arbitrary shell benchmarks via subprocess/SSE and prompting subagents to run exact commands and “return ONLY the final JSON” — which is suspicious steering that reduces security boundaries though not explicitly malicious.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In scripts/diagnosis.py:round_dogpile() the orchestrator builds a free-text query from tournament history (including prior /dogpile outputs) and passes it as the search string to /dogpile via scripts/research.py:dogpile_research() (./run.sh search "{query}"), so outsider-authored free text can be ingested indirectly through prior rounds/dogpile results rather than only trusted internal docs.