build-repo

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The required workflow ingests outsider-authored free text from the cloned TS/JS repository itself—specifically README/docs prose, workflow/YAML, and script/package.json contents used to extract commands (and it repeats this across phases during the convergence loop).

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill explicitly instructs the agent to install system packages (apt), install system-level libraries, and start backing services in the sandbox—actions that modify the machine state and commonly require elevated privileges.