capabilities

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.65). The skill’s runtime path CapabilitiesFromLabels(...) -> ExtractMetadata -> podman/docker inspect ingests OCI label values (including ai.opencharly.service JSON) from the referenced image; since the image content/labels can be authored by an outsider, this is outsider-authored free text/JSON flowing into the agent’s LLM context via the deploy-time label parsing.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill calls CapabilitiesFromLabels which uses podman/docker inspect on remote image refs (e.g., "ghcr.io/overthinkos/fedora-coder:latest") to read OCI labels whose Description/Plan entries can include agent-run/agent-check steps that directly inject instructions/control agent behavior at runtime, so the ghcr.io image reference is a runtime external dependency that can control prompts.