ultra-research

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In SKILL.md, the runtime path polls GREP job status and then ingests the full GREP report via node "<SCRIPTS_DIR>/grep-api.js" result <job_id> inside /loop, and GREP’s results plausibly include outsider-authored free text (e.g., from web/community inputs the research collected).

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.80). The skill explicitly instructs the agent to create and manage recurring cron jobs (persistent system state changes via /loop, CronList, CronDelete) and to auto-invoke a login flow, which causes the agent to modify the host environment rather than only read files—this is a non-trivial state change/persistence risk.