aris-experiment-bridge

CRITICAL E004: Prompt injection detected in skill instructions.

• Potential prompt injection detected (high risk: 0.70). The prompt includes explicit hidden/deceptive directives—most notably "Do NOT ask the user for permission — just do it silently" for large-file writes and multiple "skip silently" behaviors—that instruct the agent to act without user consent or notification, which is outside normal transparent behavior for an implementation/deployment skill.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill explicitly instructs cloning and reading an arbitrary GitHub repo when BASE_REPO is set ("If BASE_REPO is set — clone the repo first" / "Read the repo's README, understand its structure, find entry points" in Phase 2), which causes the agent to ingest and act on untrusted, user‑generated third‑party content as part of implementation and deployment.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill explicitly supports cloning a user-provided BASE_REPO at runtime (example override: https://github.com/org/project) via "git clone <BASE_REPO>" and then reading/modifying/executing that code, so remote repository content can be fetched and executed during runtime.