detecting-serverless-function-injection

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 1.00). Both URLs point to an untrusted domain (attacker.com) and include a direct .sh script download plus an obvious exfiltration endpoint over HTTP, which are strong indicators of a malicious download/exfiltration vector and thus high risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The required runtime workflow includes downloading function deployment packages and layer packages from AWS (aws lambda get-function ... Code.Location and aws lambda get-layer-version ... Content.Location), which are outsider-authored free-text artifacts (code/content) that the agent then unzips and scans with grep/semgrep/bandit, making them LLM-readable and thus an indirect prompt-injection risk.