crabbox

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The SKILL.md explicitly instructs fetching and acting on open/public user content — e.g., the "--fresh-pr owner/repo#123|URL|number" flow to create a fresh remote checkout of a GitHub PR (and examples like "desktop launch --url " / WebVNC opening arbitrary pages) — meaning untrusted third‑party content is ingested and can directly influence commands and decisions.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.80). The prompt explicitly instructs running privileged operations (e.g., "sudo ln -sf ... /usr/local/bin/") and references use of sudo/apt and system-level installs on targets, which directs an agent to modify system files and request elevated privileges.