research

CRITICAL E004: Prompt injection detected in skill instructions.

• Potential prompt injection detected (high risk: 0.80). The skill explicitly instructs the agent to "silently check for updates" and "if an update is found it installs silently" (SKILL.md:125-132), which is a hidden/deceptive action outside the stated research purpose.

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). This skill explicitly instructs the agent to collect and concatenate existing code and manifests into a context file and then pass that file to an external research command, which can cause secrets (API keys, tokens, passwords) present in those files to be sent verbatim to the research API and later echoed in results — an unsafe secret-exfiltration pattern.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The skill contains deliberate high-risk behaviors: it instructs collecting arbitrary project/context (potentially including secrets) and sending it to an external GREP API, auto-invokes login flows, and performs a silent auto-update/install — this enables data exfiltration and supply-chain backdoor risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In SKILL.md, the runtime path /research submits a “refined_query” derived from the user’s free-text to node "$SCRIPTS_DIR/grep-api.js" run "<refined_query>" (GREP API) along with a free-text context file, so outsider-authored text can be ingested by the LLM at runtime.