penetration-testing

CRITICAL E004: Prompt injection detected in skill instructions.

• Potential prompt injection detected (high risk: 0.90). The "Companion check" secretly instructs the agent to run local shell commands (ls of ~/.claude/... and offer npx installs) to inspect and modify the host environment—an out-of-scope, operational instruction that effectively requests local filesystem access and installs, which is hidden/deceptive relative to the pentesting guidance.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.80). The skill's reconnaissance and methodology sections explicitly instruct gathering and analyzing public OSINT from untrusted third-party sources (e.g., Google dorks, Shodan, crt.sh, GitHub/GitLab, LinkedIn) which the agent is expected to read/interpret as part of the testing workflow and could materially influence subsequent actions.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (medium risk: 0.60). The skill includes an explicit "companion check" that tells the agent to run local filesystem commands (ls through hidden skill directories) and to offer/perform installs via npx skills add ..., which would read local files and can modify the host by installing packages (even though it does not request sudo, create users, or directly edit privileged system files).