herdr-goal

CRITICAL E004: Prompt injection detected in skill instructions.

• Potential prompt injection detected (medium risk: 0.30). The skill explicitly instructs weakening security controls (e.g., recommending --dangerously-skip-permissions and advising use of rtk proxy to bypass filters), which is suspicious steering without clear malicious intent.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In SKILL.md’s required runtime workflow, the orchestrator monitors lead panes and performs unbounded reads of their “recent-unwrapped”/“visible” contents via herdr pane read and then forwards via herdr pane run, meaning outsider-authored free text can be ingested from within the monitored pane UI/context.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.90). The skill explicitly instructs spawning leads with a "--dangerously-skip-permissions" flag (an instruction to bypass permission/safety controls) and also contains commands that perform repo/init/infra actions (e.g. git init, terraform apply) that can modify state, so it pushes behavior that can compromise the machine or environment.