office-hours

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill explicitly runs WebSearch and instructs the agent in Phase 2.75 "Landscape Awareness" to "read the top 2-3 results" (and the preamble/intro may open external URLs like https://garryslist.org), so it ingests and uses untrusted public web content to inform premises, alternatives, and next actions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill's setup step runs "curl -fsSL https://bun.sh/install | bash" when bun is missing, which fetches and executes remote installer code at runtime and is a required dependency for the browse/setup flow, so https://bun.sh/install is a high-confidence runtime risk.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (medium risk: 0.60). The skill's preamble and setup steps instruct the agent to run many local shell commands (mkdir, touch, find/delete, echo to analytics), perform update/telemetry actions, and even run an external installer via curl | bash — all of which modify the host's state and can execute remote code; it does not request sudo or create system users, but it still mutates the machine and can be risky.