exploiting-bgp-hijacking-vulnerabilities

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.80). The skill's required workflow and agent script explicitly fetch and parse public, user-visible BGP data from third-party internet sources (e.g., RIPEstat endpoints like /rpki-validation, /announced-prefixes, /routing-status, /looking-glass in scripts/agent.py and the SKILL.md pybgpstream/curl examples), and that untrusted JSON/route data is read and used to make assessment decisions, so external content could influence the agent's actions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill instructs users to run "sudo bash -c "$(curl -sL https://get.containerlab.dev)\"" to install Containerlab, which fetches and immediately executes a remote shell script at runtime and is a required dependency for the lab workflow (https://get.containerlab.dev).

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.80). The prompt includes explicit sudo commands (e.g., installing containerlab and deploying the lab with sudo) and instructions that modify the host environment (installing global packages, running containers and binding config files), which ask the agent to perform privileged, state-changing operations on the machine.