deploy-linux-host-explorer

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The skill’s required runtime workflow ingests outsider-authored free text at multiple points by requiring the user to paste back command output that originates from Observe responses (e.g., observe auth status | wrap, observe-agent status | wrap, and observe datastream view <DATASTREAM_ID> | wrap), meaning an untrusted tenant/user can cause the workflow to ingest instruction-shaped text unless it is safely interpreted inside the <untrusted-data ...> wrapper.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill explicitly states it will "read the docs section" from https://docs.observeinc.com/docs/configure-the-observe-agent-on-linux-windows-and-macos at apply time to obtain YAML that it then applies to the agent, meaning remote content fetched at runtime directly controls the configuration applied.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.90). This skill orchestrates installing the Observe Agent on the host (adds repos, writes /etc/observe-agent/observe-agent.yaml and enables a systemd service) by instructing the agent to run the collection/install sub-skill, which will modify system files and require elevated privileges.