design-control-loop

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.85). The content is a legitimate agentic control-loop framework but includes explicit, high-risk patterns: sending repository context and PR data to third-party LLM providers (Anthropic/OpenAI) and using agent-runner flags that bypass permissions/enable "danger-full-access" or "dangerously-skip-permissions" (and "ask-for-approval never"), which together permit remote code execution and easy exfiltration of code or secrets to external services and artifact uploads; these choices materially enable deliberate data exfiltration and remote control of the runner.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The required runtime workflow for this skill includes a /iterate path that fetches PR body and issue/review comments via gh api in references/agent-iteration.ts, and those comment bodies are outsider-authored free text that gets injected into the agent prompt (renderIterationPrompt includes # PR Issue Comments / # PR Review Comments).

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill's workflow and agent-runner templates explicitly install and run external agent CLIs at runtime (e.g., "npm install -g @anthropic-ai/claude-code" and "bunx @humanlayer/cli@latest codelayer" from references/agent-runner-templates.md), which fetch and execute remote code used to run and process agent prompts (examples: https://www.npmjs.com/package/@anthropic-ai/claude-code, https://www.npmjs.com/package/@humanlayer/cli), so these are runtime external dependencies that execute code.