performing-ssl-tls-inspection-configuration

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). The runtime workflow in scripts/agent.py performs check_inspection_active() by connecting to external hosts provided at execution time (sys.argv[2:]) and extracting certificate fields (s.getpeercert(...)) from that network TLS session, so attacker-supplied hostnames can influence the free text (certificate issuer/subject strings) the agent ingests.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill explicitly instructs creating an internal CA and installing it into system certificate stores using administrative commands (openssl CA key/cert generation, Import-Certificate to LocalMachine\Root, sudo security add-trusted-cert, sudo cp/update-ca-certificates), which modify system trust stores and require elevated privileges and therefore can compromise the host's state.