penetration-testing

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). These URLs include an attacker-controlled endpoint and public bucket-scanning API plus many cloud metadata / internal service endpoints (IMDS, GCE metadata, Kubernetes API) that are commonly abused (e.g., via SSRF) to retrieve credentials or host/distribute malicious payloads, so the list is suspicious.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). The skill’s only explicit LLM-ingest “outsider-authored text” path is the user-provided trigger/requirement context (free text) described in its runtime “Triggers”/“Input Context Required,” but it does not specify reading from any external queue/feed/inbox/chat/ticket/webpage source without first selecting a specific item.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.80). The skill explicitly includes an "Execution Phase" step to "Execute state modifications" and other phases (bootstrapping env vars, validating keys, purging volatile memory, establishing TLS tunnels) that imply performing privileged or state-changing operations on the host, which can lead to modifying system state or requiring elevated privileges.