agents-debug

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). All other links are to official vendors or well-known GitHub projects and look low-risk, but https://astral.sh/uv/install.sh is a direct shell-install script on a small/third-party domain (curl | sh pattern) which is a high‑risk distribution vector for malware.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.65). The required runtime workflow “read traces and logs automatically” uses the AgentCore CLI to fetch trace/log text (e.g., agentcore traces get <traceId> ... and agentcore logs ...), and those trace/log payloads can include user/outsider-authored content from requests/tools that were not authored by the operating user, which the skill then feeds into the agent’s LLM context for diagnosis.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's environment-check instructions include a curl pipe that downloads and executes a remote installer (curl -LsSf https://astral.sh/uv/install.sh | sh), which fetches and runs remote code at runtime.