build-iterated-agentic-loop

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The workflow and runner templates intentionally grant headless coding agents broad runner and network privileges (e.g., "bypassPermissions", "dangerously-skip-permissions", "sandbox danger-full-access"), embed repository content into remote prompts, and expose GH/API secrets to external LLM providers — a pattern that enables easy data exfiltration, remote code execution, and credential abuse.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.95). The workflow injects github.event.comment.body (outsider-authored /iterate feedback from an issue comment) into the agent prompt via --comment-body "$COMMENT_BODY" and then into the LLM context through agent-iteration.ts and the subsequent CodeLayer --prompt call.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The workflow templates install and run external agent CLIs at runtime (e.g., "npm install -g @anthropic-ai/claude-code" and "bunx @humanlayer/cli@latest codelayer"), which fetch remote packages from registries (e.g., npm) during the job and then execute those tools with the repository prompt (PROMPT), so these runtime-fetched packages directly execute code and control agent prompts.