console-injectable-ui

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). The list contains a direct shell installer URL (https://install.iii.dev/iii/main/install.sh) that the README pipes to sh (curl | sh), which is a high-risk distribution pattern for arbitrary binaries/scripts and a common malware vector.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). The content documents a runtime "injectable UI" capability that allows workers to push and hot-reload arbitrary ESM/CSS into every open console tab with no sandbox and full console-origin privileges (plus ordering/override semantics), which enables remote code execution / persistent backdoors and supply-chain risk (notably a piped remote installer) if abused.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The workflow’s runtime only ingests outsider-authored free text via in-chat FunctionCallMessage fields (input/output and errors) that are rendered through FunctionCallMessage.tsx and custom ToolView.tryRender* branches, so attacker-provided tool payloads can reach the UI without selecting a specific trusted item first.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The README contains a curl | sh install command that fetches and executes remote code at runtime from https://install.iii.dev/iii/main/install.sh, which is a direct runtime external dependency that executes remote code.