opendeploy

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.65). The required runtime workflow ingests user-provided local source files (including arbitrary repo content) into the agent’s LLM context via local analysis/plan evidence (e.g., opendeploy analyze . --json / deploy plan . --json and subsequent “verify evidence directly in source files”), and those files can contain outsider-authored free text such as README/docs/comments or other repository text the user did not author.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill includes an explicit curl-pipe installer that would fetch and execute remote code at https://raw.githubusercontent.com/opendeploy-dev/opendeploy-opencode/main/install.sh (curl -fsSL ... | bash), which is a runtime action that executes remote script content.