writing-security-reports

CRITICAL E004: Prompt injection detected in skill instructions.

• Potential prompt injection detected (high risk: 0.70). The document explicitly defines a reporting-only role that "does NOT discover, test, or verify," yet elsewhere mandates using a vulnerability-verification sub-skill and tells the agent to "re-verify" by re-running discovery commands — instructions that prescribe testing actions outside the skill's stated purpose.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.70). The skill explicitly instructs authors to provide exact file-and-directive remediation for vendor/system configuration files (e.g., /etc/nginx/conf.d/security-headers.conf and /etc/apache2/apache2.conf), which pushes actions that would require modifying system files (and thus sudo) on the machine the agent runs on.