hunt-cicd

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The Phase 3 workflow pulls recent run logs from a repo's public Actions runs and greps them, and outsiders can trigger those runs (for example, via fork PRs whose titles and branch names get echoed into logs), so attacker-influenced text reaches the agent without it selecting a specific item.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The skill instructs executing jenkins-cli.jar downloaded from a user-selected target host (/jnlpJars/), which is arbitrary, unauthenticated code and therefore weak provenance and high tier, while the rhysd/actionlint extension is an individual-owned repository (medium) and the other URLs are outbound, target-analysis, or placeholder references.