rlm-run

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.65). The required workflow is daytona-smoke/DaytonaInterpreter staging a repo from a user-supplied --repo <url> (public web content / outsider-authored text) into the runtime sandbox that the agent’s LLM can read for subsequent RLM calls, creating an indirect prompt-injection risk.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The DaytonaInterpreter is shown staging a remote repository at runtime via repo_url (e.g., "https://github.com/your-org/your-repo"), which will fetch external repo contents into the sandbox and can therefore supply prompts/context or executable code used by the agent.