setup-proactive-jupi

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). At runtime, Proactive-Jupi’s scheduled routines (via act-or-decide / update-brain / refresh-backlog) ingest free text from first-party tools the user connects (mail/chat/docs/etc.) without any required step to select specific items, meaning outsider-authored content can flow into the LLM through those connectors.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.80). The skill instructs the agent to write and merge security-sensitive settings (e.g., force permissions.defaultMode:"dontAsk" and an allowlist in .claude/settings.json) and to use shell-based writes to bypass tool-level write restrictions, which changes the machine/workspace security posture and enables unattended command execution.