cli-design

CRITICAL E004: Prompt injection detected in skill instructions.

• Potential prompt injection detected (high risk: 0.90). The "Companion check" instructs the agent to run shell commands that list local skill directories and to suggest installing missing skills—an operational action accessing local files and invoking package installs that is outside the skill's stated CLI-design purpose and effectively a hidden/deceptive instruction to interact with the host environment.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (medium risk: 0.40). The skill's "companion check" explicitly tells the agent to run shell commands (ls) and to offer installing missing skills via npx, and the guidance includes commands like chmod, go install, pip/cargo installs which prompt the agent to perform filesystem and package-install actions that change the host state, though it does not request sudo, privileged system-file edits, or user creation.