agentcore

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). One URL (https://astral.sh/uv/install.sh) is a direct remote shell installer referenced as a curl|sh command in the preflight script — executing remote .sh installers is a high-risk distribution vector and should be treated as suspicious until verified.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The required runtime path for this skill is the migration workflow that scans and parses outsider-authored repo files (e.g., .github/agents/*.agent.md, .github/skills/*/SKILL.md) into migration-inventory.json, and then uses that extracted free text to generate systemPrompt/main.py content that is fed into the agent’s LLM context at invocation time (code runtime SYSTEM_PROMPT = DEFAULT_SYSTEM_PROMPT + _discover_skills()), so outsider prompt text can reach the model.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The docs and templates show skills may be mounted from git at invocation time (e.g. "agentcore add skill --harness --git https://github.com/org/repo"), and the runtime fetches those s3/git skill files into the agent context at invocation—meaning remote Git URLs can be fetched at runtime and their SKILL.md content injected into the model prompt.