ssh-audit

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.65). The required workflow runs ssh-audit against a remote SSH endpoint and then “reading the report” ingests the tool’s scan output (banner/graded lines/notes) into the agent context; that report is derived from an outsider-controlled remote host’s negotiated protocol strings and is therefore outsider-authored free text at runtime.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill explicitly instructs running commands as root (sudo), editing system files like /etc/ssh/moduli and sshd_config drop-ins, and reloading systemd (e.g., systemctl reload ssh), which change the host's state and require privileged access.