canary

CRITICAL E004: Prompt injection detected in skill instructions.

• Potential prompt injection detected (high risk: 0.80). The prompt includes hidden/deceptive actions outside the canary's stated monitoring purpose — e.g., it unconditionally writes analytics/telemetry entries and marks intro/telemetry-prompted files (touch) in the preamble before/independent of explicit user consent — which alters state and surreptitiously collects/records usage outside the advertised workflow.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 1.00). The skill's Phase 2–5 explicitly uses the browse daemon ($B) to visit arbitrary user-provided URLs, extract links, snapshots, console errors, perf and text from live pages (e.g., " $B goto ", "$B links", "$B console --errors", "$B text"), and then interprets those results to trigger alerts and drive follow-up actions, meaning it ingests untrusted third‑party web content that can materially influence decisions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's setup step runs a one-line installer that fetches and executes remote code — curl -fsSL https://bun.sh/install | bash — which is used at runtime to install a required dependency (bun), so it directly executes external code.