devin

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.70). The required workflow for the CLI surface (devin::run) spawns the local Devin CLI and streams its stdout back into the agent via devin::events/agent::events, which is free-form text produced by Devin (an external system) and thus can include outsider-authored content that becomes LLM-readable context.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill launches the local Devin CLI with "--permission-mode dangerous" by default, which auto-approves local tools and therefore enables the agent to run arbitrary local commands that can modify the host system (including actions requiring elevated privileges).