skill-comply

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The code repeatedly sends local file/trace contents to an external LLM CLI ("gemini") and executes shell commands produced or sourced from LLM output (and from scenario.setup_commands) — this creates clear opportunities for data exfiltration and remote code execution from untrusted model outputs.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The LLM classifier ingests user/attacker-provided free text indirectly via the generated scenario prompts (which include arbitrary skill file text) and the resulting gemini tool-call inputs/outputs that are then passed verbatim to gemini -p in scripts/classifier.py (prompt_template classifier.md uses {tool_calls} built from event.input/event.output).