security-incident-response

CRITICAL E004: Prompt injection detected in skill instructions.

• Potential prompt injection detected (high risk: 1.00). The companion-check section instructs the agent to run filesystem commands and install packages (ls and npx) which are unrelated to incident response and attempt to access/modify the host environment, constituting a hidden/deceptive instruction outside the skill's stated purpose.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The playbooks and detection/analysis steps (references/incident-playbooks.md and SKILL.md) explicitly instruct querying public services and advisories—e.g., submitting hashes to VirusTotal/id-ransomware, checking Have I Been Pwned, and vendor security advisories—so the agent would ingest untrusted, user/third‑party content that could materially influence actions.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.80). The skill explicitly instructs the agent to run shell commands (ls) and optionally install companion skills (npx), and its forensic/containment playbooks direct privileged, state-changing actions (memory dumps, disk images, revoking credentials, isolating hosts, modifying persistence like cron/authorized_keys) that would modify the host and often require elevated privileges.