ai-agent-design

CRITICAL E004: Prompt injection detected in skill instructions.

• Potential prompt injection detected (high risk: 0.80). The prompt includes an explicit "companion check" that instructs the agent to run shell commands (ls on multiple ~/.claude/skills paths and offer npx installs) to inspect and modify the host environment — a side‑effectful, local-file access & install step that is outside the stated scope of "AI agent design" and could expose or change local data, so it functions as a hidden/deceptive instruction.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 1.00). The skill's SKILL.md explicitly defines and uses a "search_web" tool and ReAct/agent-loop examples (and the references/agent-patterns.md ReAct examples) that fetch web titles/URLs/snippets and append those observations into the agent's context, so the agent ingests untrusted public web content that can materially influence subsequent tool use and decisions.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.80). The skill defines a write_file tool that can overwrite arbitrary absolute file paths (which could be used to modify system/privileged files) and its companion check encourages running shell commands/installing skills (npx), enabling changes to the host state even though it doesn't explicitly request sudo or user creation.